Staff Security Engineer

Jellyfish; United States; Remote; USD 180,000 - 260,000; Full time

Job summary

Jellyfish is seeking a Staff Security Engineer to own and lead all security engineering. You will define vision, build strategy, and scale the security program with hands-on coding and architecture leadership across SaaS platforms.

You’ll partner with engineering leadership to embed security into the DNA, drive automated vulnerability management, and lead threat modeling and incident response at scale. Remote-friendly, EST/CST alignment preferred.

Qualifications

• Extensive track record building and scaling security programs in SaaS or startups.
• Deep AI/LLM security experience and securing internal AI tooling and customer apps.
• Strong security governance, risk management, and compliance mindset.

Responsibilities

• Define and drive the strategic security roadmap aligned with business goals.
• Architect scalable security architectures across core infra and product stack.
• Own SDLC with automated threat modeling and continuous risk assessments.
• Lead secure AI development practices for internal tools and customer features.
• Oversee threat modeling, risk assessments, and incident response strategies.
• Mentor engineers and influence leadership on security posture.

Skills

Security leadership

Application security

Threat modeling

Secure SDLC

Cloud security

Education

Bachelor’s/Master’s in CS or related

Tools

AWS

Terraform

Semgrep

LLVM

Job description

The posted range represents the possible base pay for this role. Actual compensation will depend on your experience, skills, role scope, and alignment with the position. Some postings may include more than one salary band to reflect different levels.

Jellyfish empowers engineering organizations to become as valuable and effective as possible by analyzing the data from tools and practices they already use. Our products help engineering leaders align their decisions with business initiatives and deliver software-- the right software, efficiently, and on time. We’re solving a real problem that people have today, and our growth is testament to the market potential.

We are looking for a Staff Security Engineer to own and lead all Security Engineering activities at Jellyfish. In this pivotal role, you will define the vision, build the strategy, and scale our security engineering program. With a deep background in application security, automated vulnerability management, and SaaS platform security, you will be the ultimate technical authority for security across the organization. You will partner closely with engineering leadership to embed security into our DNA while continuing to stay hands-on by building security features and writing high-quality code. This is a unique opportunity to have complete ownership of security at a high-growth company.

If this sounds exciting, we’d like to hear from you!

What you’ll do:

Define Security Strategy & Roadmap: Own and drive the strategic security roadmap, aligning overarching security initiatives with executive business objectives and mitigating top-tier organizational risks.

Architectural Leadership: Own, design, and mandate scalable, resilient security architectures across our core infrastructure, platform, and product ecosystem.

Own the SDLC: Define, implement, and govern the Secure Development Lifecycle (SDLC) company-wide, pioneering automated threat modeling, continuous risk assessments, and secure development practices.

Secure AI Development & Governance: Partner closely with engineering and data science teams to establish and enforce secure development lifecycle (SDLC) practices specifically for both internal AI tools and customer-facing AI features.

AI Threat & Risk Modeling: Lead comprehensive threat modeling and continuous risk assessments tailored to artificial intelligence and machine learning ecosystems, mitigating unique risks such as prompt injection, data poisoning, and sensitive data leakage.

Drive Automation at Scale: Spearhead the overarching strategy and development for automated remedial workflows, comprehensive vulnerability management, and advanced software composition analysis solutions.

Mentorship & Cross-Functional Influence: Act as the definitive security leader, mentoring engineers, advising executive leadership on security posture, and cultivating a pervasive culture of security and inclusion.

Lead Threat & Incident Management: Direct the organizational response for critical security incidents, oversee manual and automated threat modeling, and dictate the strategy for pentesting and bug bounty programs.

About you:

Extensive, proven track record of owning, building, and scaling application security programs in a SaaS or fast-paced startup environment.

Deep understanding of the unique security challenges presented by Artificial Intelligence and Large Language Models (LLMs), with practical experience securing both internal AI infrastructure and customer-facing AI applications.

A forward-thinking approach to AI risk management, possessing the ability to balance rapid AI product innovation with rigorous security, compliance, and data privacy standards.

Demonstrated ability to drive cross-functional consensus, influence engineering leadership, and execute large-scale performance, testing, and security initiatives.

You possess strong business acumen, naturally balancing the needs of the user, product velocity, and enterprise security when dictating solutions.

You are a recognized expert who loves tackling complex research in computer security and sharing your knowledge through technical talks and engineering-wide education.

You thrive in autonomous environments, adept at identifying gaps, setting the direction, and executing with a distributed team.

You are eligible to work in the U.S. for any employer.

Located in EST or CST time zone (preferred).

You bring expert-level skills with our technology stack and cloud environments (Python, Django, Postgres, AWS, Terraform, Circle CI/GitLab/GitHub Actions, Semgrep, LLVM).

You are a prominent voice or active contributor in open-source security projects, standardizations, or industry working groups (e.g., OpenSSF, Mozilla).

You have experience transforming the ways security and engineering teams collaborate, implementing cutting-edge tools to reduce friction and improve security posture.

You have led security at a high-growth startup before, and loved it.

We believe that it takes a diverse team to build the best company we can. Jellyfish welcomes people from all backgrounds and especially encourages applications from members of groups underrepresented in the software industry.

A list of job experiences and qualification requirements is great, but humility, a performance-driven attitude, and a team-player approach are most important to us. We love to have fun and win in the process. We only hire people who have a passion for building great companies in an environment where a sense of humor is a must.

Occasional travel may be required.

Applicants must be authorized to work for any employer in the US. We are unable to sponsor or take over sponsorship of an employment visa at this time.

Let’s talk about us!
This is all about you, but you want to know a little about us. Jellyfish is the leading intelligence platform for AI-Integrated engineering, helping more than 1,000 companies including DraftKings, Keller Williams and Blue Yonder, leverage AI to transform how they build software. By combining the industry’s deepest engineering dataset with context-rich intelligence, Jellyfish helps R&D organizations understand what’s driving impact, adopt proven industry best practices, and make smarter decisions across AI adoption, planning, delivery, and engineering performance.