Security Lead, Product and Infrastructure (InfoSec)

River AI Inc.•Palo Alto, CA

6d•$200,000 - $420,000

About The Position

River AI is seeking a deeply technical, operationally rigorous security lead to build and lead security from the ground up. As the company’s first security hire, this person will define how River AI protects its research infrastructure, model weights, corporate assets, and customer-facing platform while supporting the pace of frontier AI development. The role combines hands-on engineering leadership, program development, and strategic vision. The Security Lead will establish capabilities across cybersecurity, detection and response, product security, and operational security. The role also owns corporate IT, identity and access management, privacy engineering, and the compliance roadmap. The position is based in Palo Alto, California, and offers a base salary of $200,000–$420,000 per year, plus equity.

Requirements

10 or more years of experience in security, with significant experience at a technology company; AI experience is preferred.
A track record as a first or early security executive in a high-velocity, high-stakes environment, with the ability to set strategy while remaining close to tooling, architecture, and incident command.
Deep expertise in at least two areas among detection engineering, incident response, digital forensics, infrastructure security, product/application security, operational security, and secure software development.
Direct experience securing cloud-native, large-scale distributed systems, container/VM environments, and high-performance compute clusters.
Demonstrated ability to build and ship security tooling or research projects, such as internal platforms, open-source tools, or commercial security products.
Ability to translate technical risk for executives, partner with research leads on novel threat models, and review code or architecture.
Intellectual curiosity about AI safety, alignment, and the security challenges of AI model and AI agent development.

Nice To Haves

Experience with model-weight protection, secure multi-party compute, confidential computing, or supply-chain security at an AI lab or research organization.
Published research, conference talks, or open-source contributions in security engineering or defensive operations.
Experience with startups or venture-backed companies.

Responsibilities

Build and scale the end-to-end security operation, including product and infrastructure security, detection engineering, incident response, GRC, and workplace security.
Protect proprietary model weights, training data pipelines, research clusters, and source code from sophisticated adversaries.
Design lightweight, automated security controls and secure-by-default infrastructure that let developers experiment safely without bureaucratic workflows.
Integrate security, IT, and privacy engineering; own corporate IT, identity and access management, and privacy engineering.
Explore how AI can improve vulnerability discovery, code analysis, defensive operations, and product security.
Represent security externally to enterprise customers, regulators, board members, and government partners.
Lead the compliance roadmap, including SOC 2, ISO 27001, and FedRAMP, to support commercial and public-sector adoption.
Recruit and mentor security engineers, operators, and researchers who automate repetitive work and embed security into the SDLC.