Staff Security Engineer (hybrid)
Fiddler AI
The Mission
As our first Security Engineer, you will define and drive the foundation of security for a next-generation developer platform that powers responsible AI. Your work ensures that every product we build, and every model our customers deploy, is secure, trustworthy, and compliant from the ground up.
You'll collaborate across Engineering and Product to embed security into our development lifecycle, enable rapid innovation without compromising safety, and lead the execution of our compliance roadmap (e.g., SOC 2, ISO 27001). By implementing the technical controls that safeguard our multi-cloud AI platform, you will play a critical role in protecting customer data, earning their trust, and reinforcing Fiddler's commitment to building AI that the world can depend on.
About The Team
Our Platform Engineering team is a talented, experienced group of engineers who take pride in building the foundation that powers Fiddler's AI platform. The team is a mix of local and remote members who thrive on open communication, transparency, and genuine teamwork. This team has a 'gsd' attitude and is quick to lend a hand, share knowledge, and celebrate wins together.
What You'll Do
Develop a comprehensive security roadmap that addresses current and future threats, including cloud security, application security, and incident response.
Directly implement half of the roadmap yourself with changes from GitHub Actions to Terraform to Python; while delegating the other half to other engineering teams. Drive execution of the engineering roadmap by personally delivering key features and infrastructure improvements (spanning GitHub Actions, Terraform, and Python), while coordinating and delegating the remaining initiatives to other engineering teams to ensure end-to-end delivery.
Own our compliance processes end-to-end, including SOC 2 Type 2, GDPR, HIPAA (and more)—by defining and updating controls, supplying evidence during audits, etc.
Prepare for and lead our incident response efforts, including developing and testing incident response plans, and coordinating the response to security incidents; work with other engineers to shift left.
What We're Looking For
5+ years security engineering experience
Proven experience as an autonomous senior security role in a startup environment.
Deep understanding of both security principles and best practices, as well as infrastructure engineering (sometimes called "DevSecOps").
Hands-on experience with a variety of security tools and technologies in the cloud (on-prem experience is nice-to-have), vulnerability management, and incident response.
Coding experience in Python and/or Golang, primarily as it relates to infrastructure tools.
Excellent communication and interpersonal skills, with the ability to effectively communicate complex security concepts to both technical and non-technical audiences.
A proactive and results-oriented mindset, with the ability to work independently, take ownership of projects and drive them end-to-end across teams.
You are comfortable with ambiguity and are a self-starter who thrives in a fast-paced environment.
Hands-on experience with AWS technologies (e.g. EC2, VPC, NLB, etc.).
A passion for security and a desire to stay up-to-date with the latest threats and technologies.
Ability to work at our Palo Alto office 2-3 days a week
Compensation:
$192,500-$295,000 for Bay Area
The posted range represents the expected salary range for this job requisition and does not include any other potential components of the compensation package and perks previously outlined. Ultimately, in determining pay, we'll consider your experience, leveling, location, and other job-related factors.
Fiddler is proud to be an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. If you require special accommodations in order to complete the interviews or perform job duties, please inform the recruiter at the beginning of the process.
Beware of job scam fraud. Our recruiters use @fiddler.ai email addresses exclusively. In the US, we do not conduct interviews via text or instant message, or ask for sensitive personal information such as bank account or social security numbers.