Security Engineer

Description

The company builds an AI-native platform that runs primary research end to end, covering study design, expert recruitment, AI-moderated interviews, and insight synthesis, cutting work that normally takes weeks down to hours.

Its AI moderator conducts thousands of expert interviews each month and turns them into time-series outputs tracking more than 10,000 public and private companies, searchable in natural language.

Customers include large enterprises, hedge funds, PE firms, credit investors, and venture capital firms. The company has 45 people and this is its first dedicated security engineering hire.

Responsibilities

• Build the security program from the ground up as the first dedicated security engineer, with the company's future growth resting on it.
• Harden the cloud environment and build logging, monitoring, and detection.
• Fix issues found in penetration tests.
• Review security for design docs and architecture changes on new features.
• Lead the ISO 27001 effort from scoping through risk assessment, controls, and the certification audit, with evidence collected automatically rather than in spreadsheets.
• Help define the security architecture and roadmap as part of the founding engineering team, writing and shipping production code.
• Report to the CTO, lead incident response, and work with the VP of Compliance and Legal on policy, customer security reviews, and the wider compliance program.

Requirements

• Have 4+ years of security engineering experience, including hands-on compliance work.
• Ideally have worked at a startup or fast-growing SaaS company where you secured cloud infrastructure directly and helped build a compliance program.
• Have strong cloud security skills on AWS or GCP, covering IAM, network security, logging and monitoring, secrets management, and encryption, and be able to read and write infrastructure-as-code.
• Be able to contribute to a production codebase and resolve issues raised in penetration tests.
• Have taken a company through ISO 27001 certification, including ISMS scoping, risk assessments, the Statement of Applicability, controls, and the audit. SOC 2 Type II experience is a plus.
• Use AI models and agentic coding tools daily, understand the security and data governance risks of LLM-based products, and know how to defend against prompt injection and data leakage.
• Work independently, communicate proactively, start work without waiting for instructions, and make and defend architecture decisions in code review.
• Bonus: experience with SIEM, EDR, CSPM, or vulnerability and container image scanning, and with compliance automation platforms such as Vanta or Drata. Also a plus if you have built reusable guardrails that make secure coding the default for other engineers.
• Bonus: experience securing LLM applications and agentic systems, including red-teaming for prompt injection, data exfiltration, and tool misuse.
• Bonus: experience building access and data segregation controls, ideally in financial services or expert networks handling MNPI and client confidentiality.
• Bonus: certifications such as ISO 27001 Lead Implementer or Lead Auditor, CCSP, AWS Security Specialty, or OSCP.
• Bonus: background in financial services or market research.

Conditions

Base salary of $160-220K, depending on experience.

Equity: a meaningful early-stage grant with value tied to company growth.

Full-time, in person in New York City Monday to Wednesday, remote Thursday and Friday.

The company is an equal opportunity employer and welcomes applicants from all backgrounds.

Benefits

• Accountability to a very high standard of quality and impact.
• A fast pace in growth, decisions, and time to impact.
• Ownership over how you work, not only what you work on.
• A chance to create the processes, playbooks, and systems that shape how the company scales.
• A small, early team working to disrupt the multi-billion dollar market research industry with AI.
• A collaborative, enjoyable working environment.