Security Lead

Trellis AI • San Francisco, CA

9d • $198,000 - $221,000

About The Position

Trellis is hiring its first Security Lead to own security end to end. The role is responsible for protecting systems that interact with electronic health records, insurance portals, and protected health information while enabling the company to ship quickly. The Security Lead will set security strategy, build and test controls, and serve as a security contact for customers. The position reports to Jacky, Co-founder & CTO.

Trellis builds and deploys self-improving AI agents that automate healthcare document intake, prior authorizations, appeals, and related coverage and reimbursement workflows. Its agents support patients and healthcare providers across all fifty states.

Requirements

• At least 6 years of experience in security engineering, including time owning security at a startup or high-growth company.
• Deep experience with AWS security, IAM, and cloud infrastructure.
• Hands-on offensive security experience, such as penetration testing, red teaming, or bug bounty work.
• Experience running vulnerability management and incident response programs.
• Experience leading SOC 2 and/or HIPAA compliance efforts and responding to customer security reviews.
• Clear communication skills with engineers, executives, and customers.
• High ownership and ability to operate autonomously in a fast-moving startup.
• Able to take direct responsibility for security, assess real risks, and work with engineers and customers.

Nice To Haves

• Comfort with Windows Server and Active Directory environments.
• Healthcare or other regulated-industry experience.

Responsibilities

• Own the security roadmap across cloud, application, endpoint, and data security, prioritizing the most important risks.
• Build guardrails and paved roads that help engineers ship quickly and safely.
• Conduct penetration tests and red-team exercises against agents, infrastructure, and the Windows session fleet, and remediate findings.
• Own AWS security posture, IAM, secrets management, least-privilege access, and trust boundaries between customers, agents, and internal systems.
• Establish vulnerability scanning, triage, and patching across code, dependencies, containers, and hosts, with clear SLAs.
• Answer customer security questionnaires, participate in diligence calls, and lead audits and certifications such as SOC 2, HIPAA, and HITRUST as needed.
• Build logging, detection, and an incident response plan, and lead response when incidents occur.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed