Member of Technical Staff, Founding Security Engineer

Pace•New York City, NY

1d•Onsite

About The Position

Pace is the AI operations platform for insurance, trusted by some of the leading carriers, specialty mutual groups, and tech-forward brokers. Almost $400bn per year is spent on outsourcing in financial services. We’re here to change that, working side-by-side with some of the largest companies in the world. We’re looking for a Founding Security Engineer to help build the security function at Pace. This is not a traditional security role. We want someone with strong security background and a customer-centric mindset: pragmatic, technical, close to the product, and focused on helping the company move quickly and safely to build trust with our customers. You’ll initially be a security generalist as we scale the product and team. You’ll work across application and infrastructure security, enterprise security and GRC, incident response, and an emerging category we care deeply about: designing secure AI and agentic systems.

Requirements

Significant experience as a security engineer, software engineer focused on security, or in another deeply technical security role.
Strong software engineering fundamentals. You can read production code, write code yourself, reason about distributed systems, and work directly with engineers on architecture.
Depth in at least one security discipline such as application security, cloud/infrastructure security, product security, identity, or detection and response.
Experience securing modern cloud applications and understanding threats across the application, infrastructure, data, and identity layers.
Strong instincts around threat modeling and designing systems that are secure by construction.
Comfort operating in ambiguous environments where the security program is still being built.
The ability to distinguish between theoretical risk and material risk, and to make pragmatic decisions without lowering the bar.
Strong communication skills. You'll work with engineers, enterprise customers, auditors, and company leadership and need to translate between all of them.

Nice To Haves

Experience with AI/LLM security, SOC 2 or similar frameworks, regulated industries, enterprise security reviews, or building a security program from an early stage is valuable but not required.
We'd rather hire an exceptional security-minded engineer who is excited to learn an unfamiliar part of this surface area than someone whose experience fits neatly into one security specialization.

Responsibilities

Build security into our product. Partner directly with engineers on architecture, threat modeling, authentication and authorization, data isolation, secrets, secure development practices, and high-risk product features.
Make agentic systems safe. Help us reason from first principles about the security boundaries of AI agents that can access sensitive data, use tools, interact with external systems, and take actions on behalf of customers.
Own application security. Identify vulnerabilities before they become incidents, improve our testing and review processes, and help engineers develop strong security instincts rather than creating a security bottleneck.
Scale our security program. Harden the systems, controls, policies, monitoring, incident response processes, and risk management practices that a company serving the world’s largest financial institutions needs.
Help own GRC and enterprise security. Work with customers, auditors, and the rest of the company on security reviews, compliance programs, questionnaires, controls, and evidence. We don't expect you to love paperwork or take on all this work independently, but you should work alongside our Head of Engineering and our third party partners to automate and ensure compliance.
Raise the security bar across Pace. Security will remain a shared engineering responsibility. Your job is to become the person who makes the whole company better at continuously improving our security posture.
AI agents introduce security questions the industry is still learning how to answer, and Pace is operating them inside highly regulated, high-consequence environments. We want someone excited to help define what excellent security looks like here.