Staff Security Engineer

OpenKrill; United States; On-site; USD 180,000 - 240,000; Full time

Job summary

Jellyfish is seeking a Staff Security Engineer to own and scale our security program. You will define strategy, build security features, and work hands-on to embed security across our SaaS platform.

You will lead threat modeling, automated vulnerability management, and secure AI governance, partnering with engineering leadership to balance rapid AI innovation with strong privacy and compliance. Located in the US, EST/CST friendly.

Qualifications

• Proven success building and scaling security programs in SaaS or startup environments.
• Strong software engineering background across Python, JavaScript/TypeScript, Rust and C/C++.
• Experience securing AI and LLM-based systems and internal AI infrastructure.
• Balanced approach to AI risk management with security, compliance and privacy.
• Ability to drive cross-functional consensus and execute large-scale security initiatives.
• Autonomous leader who can guide distributed teams and balance user needs with security.
• Authorized to work in the United States.
• EST or CST time-zone preferred.

Responsibilities

• Define security strategy and roadmap aligned with business objectives.
• Architect scalable, resilient security architectures across core infrastructure and product.
• Own the Secure Development Lifecycle (SDLC) with automated threat modeling and risk assessments.
• Secure AI development and governance for internal and customer-facing AI features.
• Lead AI threat modeling and risk assessments tailored to AI/ML ecosystems.
• Drive automation for vulnerability management and software composition analysis.
• Mentor engineers and influence leadership to cultivate a security-focused culture.
• Oversee incident management, pentesting and bug bounty strategy.

Skills

Python

JavaScript/TypeScript

Rust

C/C++

Tools

AWS

Terraform

CircleCI/GitHub Actions

PostgreSQL

Semgrep

LLVM

Django

Job description

Jellyfish empowers engineering organizations to become as valuable and effective as possible by analyzing the data from tools and practices they already use. Our products help engineering leaders align their decisions with business initiatives and deliver software-- the right software, efficiently, and on time. We’re solving a real problem that people have today, and our growth is testament to the market potential.

We are looking for a Staff Security Engineer to own and lead all Security Engineering activities at Jellyfish. In this pivotal role, you will define the vision, build the strategy, and scale our security engineering program. With a deep background in application security, automated vulnerability management, and SaaS platform security, you will be the ultimate technical authority for security across the organization. You will partner closely with engineering leadership to embed security into our DNA while continuing to stay hands‑on by building security features and writing high-quality code. This is a unique opportunity to have complete ownership of security at a high-growth company.

WHAT YOU’LL DO:

• Define Security Strategy & Roadmap: Own and drive the strategic security roadmap, aligning overarching security initiatives with executive business objectives and mitigating top-tier organizational risks.
• Architectural Leadership: Own, design, and mandate scalable, resilient security architectures across our core infrastructure, platform, and product ecosystem.
• Own the SDLC: Define, implement, and govern the Secure Development Lifecycle (SDLC) company-wide, pioneering automated threat modeling, continuous risk assessments, and secure development practices.
• Secure AI Development & Governance: Partner closely with engineering and data science teams to establish and enforce secure development lifecycle (SDLC) practices specifically for both internal AI tools and customer‑facing AI features.
• AI Threat & Risk Modeling: Lead comprehensive threat modeling and continuous risk assessments tailored to artificial intelligence and machine learning ecosystems, mitigating unique risks such as prompt injection, data poisoning, and sensitive data leakage.
• Drive Automation at Scale: Spearhead the overarching strategy and development for automated remedial workflows, comprehensive vulnerability management, and advanced software composition analysis solutions.
• Mentorship & Cross-Functional Influence: Act as the definitive security leader, mentoring engineers, advising executive leadership on security posture, and cultivating a pervasive culture of security and inclusion.
• Lead Threat & Incident Management: Direct the organizational response for critical security incidents, oversee manual and automated threat modeling, and dictate the strategy for pentesting and bug bounty programs.

ABOUT YOU:

• Extensive, proven track record of owning, building, and scaling application security programs in a SaaS or fast‑paced startup environment.
• Deep technical expertise in software engineering (e.g., Python, JavaScript/TypeScript, Rust, C/C++) combined with architectural‑level understanding of reliability, safety, and security.
• Deep understanding of the unique security challenges presented by Artificial Intelligence and Large Language Models (LLMs), with practical experience securing both internal AI infrastructure and customer‑facing AI applications.
• A forward‑thinking approach to AI risk management, possessing the ability to balance rapid AI product innovation with rigorous security, compliance, and data privacy standards.
• Demonstrated ability to drive cross‑functional consensus, influence engineering leadership, and execute large‑scale performance, testing, and security initiatives.
• You possess strong business acumen, naturally balancing the needs of the user, product velocity, and enterprise security when dictating solutions.
• You are a recognized expert who loves tackling complex research in computer security and sharing your knowledge through technical talks and engineering‑wide education.
• You thrive in autonomous environments, adept at identifying gaps, setting the direction, and executing with a distributed team.
• You are eligible to work in the U.S. for any employer.
• Located in EST or CST time zone (preferred).

BONUS POINTS IF:

• You bring expert‑level skills with our technology stack and cloud environments (Python, Django, Postgres, AWS, Terraform, Circle CI/GitLab/GitHub Actions, Semgrep, LLVM).
• You are a prominent voice or active contributor in open‑source security projects, standardizations, or industry working groups (e.g., OpenSSF, Mozilla).
• You have experience transforming the ways security and engineering teams collaborate, implementing cutting‑edge tools to reduce friction and improve security posture.
• You have led security at a high‑growth startup before, and loved it.

We believe that it takes a diverse team to build the best company we can. Jellyfish welcomes people from all backgrounds and especially encourages applications from members of groups underrepresented in the software industry.

A list of job experiences and qualification requirements is great, but humility, a performance‑driven attitude, and a team‑player approach are most important to us. We love to have fun and win in the process. We only hire people who have a passion for building great companies in an environment where a sense of humor is a must.

Occasional travel may be required.

Applicants must be authorized to work for any employer in the US. We are unable to sponsor or take over sponsorship of an employment visa at this time.

Let’s talk about us!This is all about you, but you want to know a little about us. Jellyfish https://jellyfish.co is the leading intelligence platform for AI-Integrated engineering, helping more than 1,000 companies including DraftKings, Keller Williams and Blue Yonder, leverage AI to transform how they build software. By combining the industry’s deepest engineering dataset with context‑rich intelligence, Jellyfish helps R&D organizations understand what’s driving impact, adopt proven industry best practices, and make smarter decisions across AI adoption, planning, delivery, and engineering performance.