Security Engineer

Qualitate•New York City, NY

4d•Hybrid

About The Position

Qualitate is hiring its first dedicated Security Engineer to build and scale the company’s security program. The role will harden the cloud environment, establish logging, monitoring, and detection, remediate penetration-test findings, and review design documents for new features and architecture changes. The engineer will lead ISO 27001 certification from scoping and risk assessment through control implementation and audit, automating evidence collection where possible. As part of the founding engineering team, this high-ownership role will help define security architecture and roadmap while writing and shipping production code. The engineer will protect confidential expert interviews and customer research, secure an AI platform that conducts thousands of interviews monthly, and support certification efforts without slowing engineering. The role reports to the CTO and partners with the VP of Compliance and Legal on incident response, policies, customer security reviews, and the broader compliance program. The position is full-time and in-person in New York City Monday through Wednesday, with remote work Thursday and Friday.

Requirements

At least 4 years of security engineering experience.
Hands-on compliance experience, including experience taking a company through ISO 27001 certification and managing scoping of the ISMS, risk assessments, the Statement of Applicability, control implementation, and audit.
Strong cloud and infrastructure security skills, including experience securing AWS or GCP environments, IAM, network security, logging and monitoring, secrets management, and encryption.
Ability to read and write infrastructure-as-code.
Ability to contribute to a production codebase and address penetration-test findings.
Fluency with AI models and agentic coding tools, and understanding of security and data-governance risks in LLM development, including prompt injection and data leakage.
High ownership, independent work habits, proactive communication, and comfort making and defending architecture decisions.
Comfort working in a fast-moving environment with broad security responsibilities and a lean team.

Nice To Haves

Startup or high-growth SaaS experience securing cloud infrastructure hands-on and helping build a compliance program.
SOC 2 Type II experience.
Experience building technical controls for ISO 27001 or SOC 2 Type II, such as access management, logging, vulnerability management, and encryption, and automating evidence collection.
Familiarity with ISMS scoping, risk assessments, or the Statement of Applicability.
Hands-on experience with SIEM, EDR, CSPM, vulnerability scanning, container image scanning, or compliance automation platforms such as Vanta or Drata.
Experience building reusable security guardrails or libraries that make secure practices easier for other engineers.
Experience securing LLM-based applications and agentic systems, including red-teaming for prompt injection, data exfiltration, and tool misuse.
Experience building technical controls for data segregation and access, ideally in financial services or expert networks involving MNPI and client confidentiality.
Security certifications such as ISO 27001 Lead Implementer or Lead Auditor, CCSP, AWS Security Specialty, or OSCP.
Background in financial services or market research.

Responsibilities

Harden Qualitate’s cloud environment and infrastructure.
Build logging, monitoring, and detection capabilities.
Remediate findings from penetration tests.
Review design documents for new features and architecture changes.
Lead ISO 27001 certification, including scoping, risk assessment, control implementation, evidence collection, and the certification audit.
Define the company’s security architecture and roadmap as part of the founding engineering team.
Write and ship production code.
Protect confidential expert interviews and customer research and secure the company’s AI platform.
Lead the response when a security incident occurs.
Partner with the VP of Compliance and Legal on policy, customer security reviews, and the broader compliance program.