Security Engineer

Variance•San Francisco, CA

7d•Onsite

About The Position

At Variance, we are teaching machines to make the hardest judgement calls at scale. That means building AI agents for the high-stakes gray-area of risk investigations, fraud, and identity reviews. We’re a small, talent-dense team in San Francisco, with former founders and talent from top AI labs. Our customers include several Fortune 500s, global marketplaces, and regulated financial institutions. If you thrive on extreme ownership, moving fast, and working directly with founders, you’ll feel at home here. We’re looking for a Security Engineer to help build that foundation. You’ll work across product, infrastructure, and internal systems to make Variance secure by design and help us meet the bar required to deploy AI into critical workflows at the largest companies in the world.

Requirements

4+ years in security engineering, DevSecOps, application security, or cloud security roles (or equivalent experience).
Strong hands-on experience in at least one major cloud provider (AWS, GCP, or Azure) and working knowledge of the others.
Experience building or securing CI/CD pipelines and applying security controls in a developer-friendly way.
Practical experience with SAST, SCA, DAST, and container scanning, including tuning and validation of findings.
Ability to perform application and architecture security reviews and communicate findings clearly to engineers.
Proficiency in at least one programming language used in modern web stacks (Python, Go, TypeScript/JavaScript, Java, or similar).
Working knowledge of Linux, networking fundamentals, identity and access management, and common web vulnerabilities (OWASP Top 10).
Strong written communication and documentation skills.

Nice To Haves

Experience in security engineering, application security, cloud security, or DevSecOps
Strong fundamentals in cloud infrastructure, identity and access management, networking, and web security
Experience securing modern product teams and development workflows
Ability to go from finding a problem to helping implement the fix
Clear written communication and strong judgment
Familiarity with GCP, infrastructure as code, CI/CD systems, and common security tooling is a plus

Responsibilities

Harden our cloud infrastructure, internal systems, and product surfaces
Build security into how we ship: CI/CD, secrets management, access control, dependency hygiene, logging, and monitoring
Review product and architecture decisions with a security lens, especially around APIs, auth, data access, and tenant isolation
Partner with engineering to find and fix real vulnerabilities quickly
Help us design abuse-resistant, trustworthy systems for AI-powered decisioning
Improve our security posture in ways that matter to Fortune 500 customers
Support customer security reviews, audits, and technical trust conversations
Create pragmatic security processes, documentation, and defaults that scale with the company