Staff Security Engineer (AI)

Location: San Francisco; remote work available in the US.

Salary: $230,000–$300,000 USD total target cash compensation annually, including base and variable compensation.

Company

hirify.global provides a product intelligence and analytics platform used by more than 29,000 companies, combining analytics with AI to help teams understand product usage and make product decisions.

What you will do

• Partner with product and engineering teams to threat model initiatives, review designs, define security requirements, and build security features.
• Design and implement product security capabilities including SSO, SCIM, access controls, audit logging, encryption, and key management.
• Lead multi-quarter remediation of systemic engineering risks through secure defaults, shared libraries, and guardrails.
• Define security baselines for GCP or AWS and Kubernetes, including IAM, RBAC, network policies, workload identity, secrets, and admission control.
• Set the security approach for AI features, agents, coding tools, MCP integrations, and vendors, addressing prompt injection, data leakage, and excessive permissions.
• Harden GitHub, CI/CD, the software development lifecycle, and secrets management while mentoring security engineers and influencing engineering leaders.

Requirements

• 10+ years of experience in security engineering, software engineering, or infrastructure engineering, including significant product or infrastructure security experience.
• Experience partnering with product and engineering teams to ship security features or platform changes.
• Deep understanding of the software development lifecycle, including design, code review, CI/CD, build, release, and deployment; ability to read code and pipeline configuration.
• Hands-on experience hardening GitHub organizations, including SSO, access management, branch protection, CODEOWNERS, Actions permissions, OIDC, secret scanning, push protection, tokens, and GitHub Apps.
• Experience designing and rolling out secrets management with centralized stores, workload identity, short-lived credentials, automated rotation, and leaked-secret detection and response.
• Deep product and application security expertise, including threat modeling, secure design review, authentication and authorization, and multi-tenant isolation.
• Experience implementing authentication, authorization, SSO using SAML/OIDC, audit logging, or encryption.
• Strong GCP or AWS infrastructure security experience, including IAM, network security, and Terraform or equivalent infrastructure as code.
• Production Kubernetes security experience, including cluster hardening, RBAC, network policies, admission controllers, and container image security.
• Experience securing AI or LLM systems or company-wide AI adoption, including prompt injection, sensitive data exposure, insecure agent tool use, and OWASP guidance.
• Experience leading cross-team systemic risk remediation, influencing senior engineers without direct authority, making pragmatic risk tradeoffs, and communicating clearly in design docs and security guidance.
• Hands-on experience using AI tools such as Claude Code to automate or scale security work.

Nice to have

• Experience securing a multi-tenant SaaS or data platform.
• Software supply chain security experience, including SLSA, Sigstore, or SBOMs.
• Service mesh or zero-trust networking experience, such as Istio or mTLS.
• Experience with AI governance, approved-tool policies, model and vendor reviews, or controls for AI agents and MCP servers.
• Experience building secure-by-default libraries or paved-road platforms, or a software engineering background.
• Experience supporting SOC 2 or ISO 27001 controls and certifications such as CKS, OSWE, or OSCP.

Culture & Benefits

• Collaboration across product, engineering, IT, legal, and security teams with emphasis on candid communication, customer focus, and pragmatic innovation.
• Medical, vision, and dental coverage; mental wellness benefit; vacation and additional holidays.
• Enhanced parental leave, volunteer time off, and US pre-tax benefits including 401(k).
• Staff technical leadership path with potential progression to Principal Security Engineer.

Hiring process

• Success expectations include a prioritized engineering risk assessment in the first three months, participation in major product and AI designs and delivery of a security feature by six months, and platform-level risk reduction and security baselines by twelve months.