Security Lead

Trellis AI; San Francisco (CA); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Comprehensive medical, dental, and视ion

Equity

Flexible PTO

Daily meals in the office

Job summary

Trellis AI is hiring a Security Lead to own security end-to-end, protecting data in healthcare workflows while enabling rapid delivery. You will set strategy, build controls, test them as an attacker would, and engage with customers on security questions and audits.

This hands-on role reports to the Co-founder & CTO and drives cloud, identity, and endpoint security across our fast-moving startup environment.

Qualifications

• Experience owning security at a startup or high-growth company.
• Deep experience with AWS security, IAM, and cloud infrastructure.
• Hands-on offensive security: pentesting, red teaming, or bug bounty.
• Experience running vulnerability management and incident response programs.
• Leading SOC 2 and HIPAA compliance efforts and customer security reviews.

Responsibilities

• Own security end to end: roadmap across cloud, application, endpoint, and data security.
• Balance security with speed: build guardrails to allow fast shipping.
• Run offensive security: pen tests, red-team, and fix findings.
• Lock down cloud and identity: manage AWS posture, IAM, secrets, and least privilege.
• Manage vulnerabilities with scanning, triage, patching and SLAs.
• Be the voice of security to customers: answer questionnaires and audits.

Skills

Security engineering

AWS security

Offensive security

Vulnerability management

SOC 2 compliance

HIPAA compliance

Identity & access management

Windows/AD familiarity

Clear communication

Autonomous startup mindset

Tools

AWS

Windows Server

Active Directory

Job description

TRELLIS BUILDS AND DEPLOYS SELF-IMPROVING AGENTS TO GET PATIENTS ACCESS TO LIFE-SAVING MEDICINE.

Our AI agents process billions of dollars worth of therapies annually with patients in all fifty states. We do this by automating document intake, prior authorizations, and appeals at scale to streamline operations and accelerate care. We classify medical referrals, understand chart notes, and automate contract and reimbursement search to provide patients with accurate coverage determinations and cost responsibility. Think of us as the infrastructure behind how patients get their medications.

Trellis is a spinout from Stanford AI Lab and is backed by leading investors including YC, General Catalyst, Telesoft Partners, and executives at Google and Salesforce.

THE ROLE

We're hiring our first Security Lead to own security at Trellis end to end. Our agents read and write to electronic health records, fill out insurance portals, and handle protected health information for some of the largest healthcare providers in the country. Customers trust us with that data, and you'll make sure that trust is earned without slowing down how fast we ship.

This is a hands-on role. You'll set the security strategy, build the controls yourself, test them like an attacker would, and be the person customers talk to when they want to know how we keep their data safe. You'll report to Jacky (Co-founder & CTO).

WHAT YOU'LL DO

• Own security end to end: Set the roadmap across cloud, application, endpoint, and data security, and decide what matters most right now

• Balance security with speed: Build guardrails and paved roads so engineers can ship quickly and safely, rather than adding gates that slow the team down

• Run offensive security: Pen test our own agents, infrastructure, and Windows session fleet; run red-team exercises and fix what you find

• Lock down the cloud and identity: Own AWS security posture, IAM, secrets management, least-privilege access, and trust boundaries between customers, agents, and internal systems

• Manage vulnerabilities: Stand up scanning, triage, and patching across code, dependencies, containers, and hosts, with clear SLAs

• Be the voice of security to customers: Answer security questionnaires, join diligence calls, and lead audits and certifications (SOC 2, HIPAA, HITRUST as needed)

• Plan for incidents: Build logging, detection, and an incident response plan, and run the response when something happens

ABOUT YOU

You've been the person responsible for security, not just a contributor to it. You're as comfortable reviewing an IAM policy or writing an exploit as you are walking a hospital CISO through our architecture. You care about real risk more than checklists, and you know that a security program engineers route around is not a security program.

WHAT YOU'LL BRING

• 6+ years in security engineering, with time owning security at a startup or high-growth company

• Deep experience with AWS security, IAM, and cloud infrastructure

• Hands-on offensive security experience: penetration testing, red teaming, or bug bounty work

• Experience running vulnerability management and incident response programs

• Experience leading SOC 2 and/or HIPAA compliance efforts and answering customer security reviews

• Comfort with Windows Server and Active Directory environments is a plus

• Healthcare or other regulated-industry experience is a big plus

• Clear communication with engineers, executives, and customers

• High ownership and the ability to operate autonomously in a fast-moving startup

WHY WORK WITH US

• Real impact at massive scale: We serve patients in all fifty states and are scaling to hundreds of healthcare locations. The systems you protect carry the health data of patients waiting on treatment.

• Incredible growth and traction: We've grown revenue 10x in the past few months alone.

• Work with the founding team: Partner directly with founders and F500 customers, alongside healthcare operations leaders who have overseen 50+ locations.

• Be at the forefront of AI in healthcare: Work on production-grade agentic systems that make critical healthcare decisions, not a demo.

• World-class team: Join teammates who have won international physics olympiads, published economics research, were founding engineers at unicorn startups, and taught AI classes to hundreds of Stanford graduate students.

Compensation & Benefits

The salary range above is our good-faith estimate. Your final level and base salary will reflect what you bring: your skills, your experience, and how much ownership you’re ready to take on. Base pay is only one part of the package. Every full-time teammate also gets meaningful equity, because the people building Trellis should share in what it becomes. We are committed to keeping you healthy and supported so you can do the best work of your career. Here are some of the benefits & perks we offer:

• Comprehensive medical, dental, and vision coverage

• Flexible PTO & Sick Time

• Daily meals in the office

• Team offsites

Equal Opportunity at Trellis

At Trellis, we're building AI agents that help patients get life-saving medicine faster. The patients and providers we serve come from every background, and our team should too. Trellis is an Equal Opportunity Employer. We hire based on talent, curiosity, and drive, without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other legally protected characteristic.

If you need an accommodation at any point in our hiring process, let your recruiter know and we'll take care of it.