Member of Technical Staff — Security

RadixArk•Palo Alto, CA

About The Position

RadixArk is looking for a Member of Technical Staff — Security to champion both our internal security posture and help us prepare for vendor audits and compliance requirements. As our first dedicated security engineer, you'll lay the foundation for security practices across our infrastructure, products, and operations—ensuring we can confidently serve enterprise customers and pass SOC 2 audits. This is a unique opportunity to shape security from the ground up at a fast-growing AI infrastructure company. You'll work across backend systems, cloud infrastructure, and customer-facing APIs to build security into our products and processes before external auditors arrive.

Requirements

4+ years working on security, infrastructure, or backend systems (or equivalent combination of hands-on experience and security training)
Strong understanding of cloud platforms: AWS, GCP, or Azure (IAM, networking, data protection, secrets management)
Proficiency in Linux/Unix system administration and command-line tools
Hands-on experience with Kubernetes, container security, or infrastructure-as-code
Solid understanding of network security, authentication/authorization protocols, and cryptography basics
Experience conducting vulnerability assessments, penetration testing, or security audits
Demonstrated experience building or improving security programs (threat modeling, security architecture, incident response)
Knowledge of secure coding practices, OWASP Top 10, and common vulnerability types (SQLi, XSS, CSRF, etc.)
Familiarity with security tools: vulnerability scanners, SIEM, secret management systems, IDS/IPS
Understanding of regulatory compliance frameworks (SOC 2 is a plus; export control is a major plus for us)
Bachelor's degree in Computer Science, Engineering, Cybersecurity, or equivalent professional experience

Nice To Haves

Background in founding or early-stage startups—you understand scrappy, pragmatic security (not over-engineering on day one)
Experience with ML infrastructure, GPU/compute management, or high-performance systems
Involvement in SOC 2 audits or other compliance programs
Experience writing security policies, playbooks, and operational runbooks
Familiarity with supply-chain security, open-source risk, or dependency management
Relevant security certifications (CISSP, CISM, CEH, OSCP, etc.) are a plus but not required

Responsibilities

Build and document our internal security architecture, controls, and practices
Create threat models for our systems and products that interact with customer data
Develop an Incident Response Plan (IRP) and Business Continuity/Disaster Recovery (BC/DR) plan
Establish vulnerability and patch management processes with clear SLAs
Prepare security documentation for vendor audits, including SOC 2 readiness
Define which systems and data handle customer data to determine SOC 2 audit scope
Create and maintain an inventory of infrastructure, applications, and third-party dependencies
Classify data flows and identify security boundaries between in-house and outsourced components
Document which security controls are managed internally vs. outsourced to vendors (AWS, GCP, etc.)
Review and improve network security: firewalls, intrusion detection/prevention (IDS/IPS), DDoS mitigation
Audit API authentication, authorization, rate limiting, and multi-tenancy isolation
Implement secrets management and secure configuration practices
Review cloud IAM, networking, and data protection (encryption in transit and at rest)
Evaluate container and supply-chain security practices
Design and implement security logging and monitoring systems
Set up SIEM/SOAR tooling or evaluate and integrate centralized logging
Establish security alerting, incident response procedures, and runbooks
Conduct regular vulnerability scans and penetration tests
Develop security processes to answer vendor questionnaires and RFPs
Create documentation for customers on security controls, certifications, and data handling
Lead the SOC 2 audit process—coordinate with internal teams and external auditors
Stay informed on relevant compliance frameworks (SOC 2, HIPAA, Export Control, etc.)
Enforce secure development practices to engineers
Help teams understand threat models relevant to their work
Build security into CI/CD pipelines and deployment processes