Security & Platform Lead

Grafton Sciences•San Francisco, CA

About The Position

We're seeking a Security & Platform Lead to architect and ship a new developer-facing platform from the ground up. You will own the full stack: desktop application architecture, security model, integration framework, and the infrastructure. This is a foundational role; you'll ship a working product in weeks, and build security into the architecture from day one. You will own the security model end-to-end, ship foundational platform primitives, and operationalize the system for correctness, security, and reliability as software becomes increasingly coupled to real-world outcomes. This role sits at the center of the stack and will shape the platform’s architecture, trust boundaries, and long-term scalability.

Requirements

Strong experience building desktop applications or developer tools (Electron, Tauri, VS Code extensions, or similar).
Demonstrated ability to ship fast: you've built and launched products in weeks, not quarters.
Deep security competence in practice: tiered security models, encryption key management, audit logging, and enterprise compliance.
Experience building adapter/plugin architectures that integrate with external tools via APIs, file formats, or automation.
Comfortable with local-first architectures: file system watching, offline-capable apps, eventual sync.
Ability to define clean contracts and interfaces that enable parallel team execution.
Comfortable across the stack: desktop app development, backend services, infrastructure, and security.
Above all, we look for candidates who can demonstrate world-class excellence.

Nice To Haves

Experience working with engineering, scientific, or design software is a strong plus.

Responsibilities

Architect and build a desktop application with a command-driven interface, project management, and real-time context awareness.
Design and implement an integration framework with standardized adapters for connecting to external professional tools via APIs, file formats, and automation.
Own security architecture across multiple tiers: from basic auth and encryption for startups, to customer-managed keys and VPC deployment for enterprises, to air-gapped and compliance-ready (SOC 2, ITAR) for regulated industries.
Build a local-first architecture: zero-upload friction, instant response, with optional cloud sync for collaboration features.
Implement core platform intelligence: tracking dependencies, detecting stale artifacts, and surfacing actionable insights.
Ship fast: deliver a working platform in weeks, iterate based on user feedback, scale based on demand.