Software Engineer, Security

XOXO AI; Home (KS); On-site; USD 250,000 - 500,000; Full time

Benefits offered by this job

Equity 1-5%

On-site at SF

Comprehensive benefits

Job summary

XOXO AI in San Francisco is seeking a seasoned Security Engineer to protect our systems and maintain user trust. You’ll harden cloud foundations, enforce access controls, and build tooling for secure development at scale.

You’ll partner with founders and engineering to embed security as a core principle, drive threat modeling, reviews, and automated guardrails that protect users and data while enabling rapid innovation.

Qualifications

• Shipped security or infrastructure systems with measurable risk improvements.
• Expert knowledge of cloud hardening, baselines, and policy enforcement.
• Strong generalist software engineering background with secure coding review.
• Hands-on security for web apps and APIs: auth flows, access control, secrets.
• Built segmentation strategies to minimize blast radius and lateral movement.
• Experience with monitoring, threat detection, and incident response in production.

Responsibilities

• Embed security into the development lifecycle with threat modeling and reviews.
• Harden cloud infrastructure and enforce network topology and org policies.
• Implement isolation/segmentation to limit blast radius and lateral movement.
• Build and maintain security tooling and automation for CI/CD and guardrails.
• Improve observability, detection, and response for security events.
• Design and manage IAM and third-party integration controls with least privilege.

Skills

Cloud security

Threat modeling

Security architecture

Web app security

IAM management

Incident response

Automation scripting

Code review for security

Tools

CI/CD security checks

Static scanning

Dynamic scanning

Cloud infrastructure tools

Job description

About Us

XOXO is a research lab building the interface of intelligence for everyday life. We're a stealth team of hardcore engineers, designers, and researchers discovering solutions to novel problems impacting life outside work.

About Us

XOXO is a research lab building the interface of intelligence for everyday life. We're a stealth team of hardcore engineers, designers, and researchers discovering solutions to novel problems impacting life outside work. With a recent breakthrough across infrastructure, architecture, and the model layer, we’re hiring serious builders to develop the interface and application layer that will bring our vision to life.

About The Role

We’re hiring a seasoned Security Engineer to protect our systems and maintain user trust. You’ll harden our cloud foundations, tighten access boundaries, and build the tooling and response loops that keep us safe as we scale. You’ll partner with the founders and engineering team to define security as a core principle in how we build.

What You’ll Do

• Partner with engineering, product, and research to embed security into the development lifecycle (threat modeling, design reviews, secure defaults).
• Harden cloud infrastructure and enforce network topology standards (subnets, firewalls, routing) and org security policies.
• Implement isolation and segmentation strategies that limit blast radius and prevent lateral movement.
• Build and maintain security tooling and automation for engineers (CI/CD checks, scanning, guardrails) and drive findings to remediation.
• Improve observability, detection, and incident response for security-relevant events (intrusions, abuse patterns, DDoS, and bots) including rapid containment.
• Design and manage identity and access management (humans + services) and third-party integration controls, prioritizing private connectivity and least privilege.

Skills & Qualifications

Minimum qualifications:

• Shipped security or infrastructure systems from design to production with measurable improvements in risk, reliability, or incident outcomes.
• Expert knowledge of cloud hardening, including configuration baselines, network topology (subnets/firewalls), and policy enforcement.
• Strong generalist software engineering background and ability to review production code for security risks.
• Hands-on experience securing web apps and APIs, especially auth flows, access control, secrets management, input validation, and data protection.
• Built segmentation/isolation strategies that reduce blast radius and prevent lateral movement.
• Deep experience with monitoring, threat detection, and intrusion mitigation/response protocols in production environments.
• Hands-on experience deploying and operating static + dynamic scanning, plus driving remediation through engineering teams.
• Strong experience designing and operating IAM for internal systems and external-facing surfaces.
• Able to ship pragmatic guardrails that increase security without slowing teams down.

Preferred qualifications - we encourage you to apply if you meet some but not all of these:

• Production experience with DDoS defense and automated abuse/bot detection and mitigation.
• Strong patterns for third-party security (private connectivity, controlled egress, vendor access controls).
• Experience implementing sensitive data protection (encryption/key management, access controls, auditability) and compliance-aligned controls.
• Strong opinions on incident response, security architecture, and pragmatic guardrails for early-stage systems.
• Experience thinking through AI/LLM product risks (abuse, data leakage, prompt injection) and building mitigations.

A link to relevant code, technical writing, incident writeups, or project work is strongly encouraged.

Logistics

• Location: San Francisco, CA (on-site)
• Compensation: $250k-$500k expected salary with 1% to 5% equity depending on background.
• Benefits: Top tier health, dental, vision benefits, and many other perks.