Security Engineer

Allium

7d

About The Position

Allium is hiring a Security Engineer to build and operate controls that protect its infrastructure, applications, employee systems, and use of AI. The role works closely with Engineering and the person leading the security program to investigate threats, implement practical fixes, and automate security work. It is a hands-on engineering position involving writing code, testing controls, investigating security signals, and carrying findings through remediation.

The Security Engineer will help secure both human and machine activity as AI agents gain access to code, data, and tools. The work includes securing agent operations and defending against automated attacks, credential theft, and compromised software dependencies. The role also supports employee security and enterprise assurance by maintaining endpoint protections and device security baselines, collaborating on identity and SaaS controls, providing technical audit and customer-review evidence, and maintaining runbooks.

Requirements

• Typically 4+ years of relevant security, infrastructure, or software engineering experience, with direct responsibility for implementing security controls.
• Hands-on experience with a major cloud platform and a strong foundation in identity, networking, operating systems, and access control.
• Depth in at least two relevant areas, such as cloud security, detection and response, application security, vulnerability management, or corporate security.
• Experience investigating technical problems from logs and system behavior, testing hypotheses, and following issues through to resolution.
• Clear communication, practical judgment, and constructive working relationships with engineers and business teams.

Responsibilities

• Implement least privilege, phishing-resistant authentication, short-lived credentials, controlled privileged access, and reliable provisioning and deprovisioning.
• Improve cloud configuration, managed credential storage, network protections, and secrets scanning with service owners; prevent credentials from entering source control.
• Help implement permissions, execution isolation, network restrictions, and audit trails for coding assistants, agents, and tool integrations, including MCP.
• Test risks from prompt injection, tool misuse, and unintended data access, and build safeguards where actions execute.
• Correlate identity, cloud, workload, and CI/CD telemetry to detect credential theft, unusual access, unauthorized agent actions, suspicious software changes, and data exfiltration.
• Investigate attacks across systems, reduce alert noise, and test response procedures with system owners, including session revocation, exposed-credential rotation, and removal of unauthorized access.
• Assess dependencies, CI/CD workflows, third-party integrations, and developer environments; partner with engineers to validate findings, protect build and deployment credentials, and remediate vulnerabilities.
• Monitor internet-facing services, evaluate new vulnerabilities and active exploitation against actual exposure, coordinate mitigation with service owners, and verify the response worked.
• Use code and APIs to improve access reviews, configuration checks, evidence collection, and remediation tracking; use AI thoughtfully while validating output and protecting sensitive data.
• Deploy, validate, and maintain endpoint protections and device security baselines, including prevention settings, tamper protection, encryption, and timely updates.
• Work with the employee IT owner on identity and SaaS controls, provide technical evidence for audits and customer reviews, and maintain useful runbooks.

Benefits

• Medical, dental, vision, life, and AD&D insurance; US employees receive 100% coverage for Gold plans and 80% coverage for dependents.
• Meaningful early-stage equity; every full-time employee receives a stock option grant.
• Flexible, trust-based paid time off; policies in every hiring country meet or exceed local statutory vacation requirements.
• Company-sponsored 401(k) plan in the US.

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed