Robots and Pencils - Staff Security Engineer
Requirements
• 7+ years of professional security or software engineering experience, with at least 3 years leading application and cloud security initiatives • Deep expertise in application security, secure coding practices, and the OWASP Top 10 • Strong experience with threat modeling, penetration testing, vulnerability management, and secure code review • Deep cloud security expertise across identity, network, and data layers • Strong experience embedding security automation and policy-as-code into CI/CD pipelines • Strong experience with detection engineering, logging, and incident response at scale • Strong experience securing AI and LLM-powered applications, including prompt injection, data leakage, model abuse, and agentic-AI threats • Experience with security, compliance, and governance frameworks • Demonstrated leadership and technical mentoring experience across a team or organization • Strong stakeholder communication skills, with the ability to translate technical depth across audiences • Demonstrable, day-to-day usage and expert knowledge of AI-forward tools such as Claude and Cursor • Excellent problem-solving skills and the ability to navigate highly ambiguous technical and business challenges with sound judgment • You’ll Do Well Here if You Are • A doer. You see something broken and fix it. You'd rather move on clarity than wait for certainty. • A doer. • A fast learner who knows you don't know everything. The AI landscape changes weekly. You're senior enough to know better and curious enough to keep learning anyway. • A fast learner who knows you don't know everything. • Direct in a way that makes the work better. You give honest feedback. You'd rather have the hard conversation than blow smoke. • Direct in a way that makes the work better. • Obsessed with craft. You know genius is in the details. You ship exceptional, not perfect, and you don't put your name on work you wouldn't stand behind. • Obsessed with craft. • Built for ownership. You honor commitments, admit mistakes fast, and back your teammates when a decision costs something. No handoffs, no finger-pointing. • Built for ownership. • All in. You treat clients' businesses like your own. You take the work seriously without taking yourself seriously. • All in. • Resourceful when the budget, timeline, or team is tight. Constraints don't slow you down. They sharpen you. • Resourceful when the budget, timeline, or team is tight.
Responsibilities
• You'll do hands-on security engineering across the areas below, listed in priority order. • Craft & Delivery • Craft & Delivery • Application security and secure engineering: deep expertise in secure coding practices, the OWASP Top 10, vulnerability management, and secure code review. Lead threat modeling and security design reviews across web, API, cloud-native, and AI systems, setting how risk is identified and prioritized. • Application security and secure engineering • Cloud security architecture: design controls across identity, network, and data layers, including secrets management and encryption. Bring deep AWS IAM expertise: cross-account trust, permission boundaries, IAM Identity Center or an equivalent federation model, policy evaluation, and Organizations with service control policies. IAM experience that stops at attaching managed policies is not sufficient. • Cloud security architecture: • Kubernetes security at meaningful scale: RBAC, admission control, Helm, and workload identity federation into cloud IAM. Local or single-cluster experience will not transfer. • Kubernetes security at meaningful scale: • Production Python: comfortable writing production Python against cloud provider SDKs, not just scripting. You will build configuration baselines, provisioning workflows, scheduled jobs, log pipelines, CLI tooling, and evidence automation. • Production Python: • Terraform: module design, state management, drift, and reviewing other teams' plans. • Terraform • Security automation in CI/CD: embed security automation and policy-as-code into pipelines, driving shift-left detection across teams. • Security automation in CI/CD • Compliance and audit evidence: own control implementation for SOC 2, ISO 27001, PCI, or equivalent frameworks, and automate evidence collection wherever possible. Willingness to do audit evidence work is mandatory. • Compliance and audit evidence: • Securing AI and LLM-powered applications: own the security of AI systems in production, defining defenses against prompt injection, data leakage, model abuse, and agentic-AI threats. • Securing AI and LLM-powered applications • SQL for investigation and evidence: Athena, BigQuery, Presto, Snowflake, or equivalent. You will query your way to most answers. • SQL for investigation and evidence: • Using AI within security workflows: LLM APIs, tool and function calling, and multi-step agent flows for detection and triage. • Securing AI training and inference infrastructure, including GPU clusters, at scale. • Cloud account lifecycle: automated provisioning and decommissioning, baselining, and inventory, including desired-state reconciliation, blast-radius reasoning, and safe rollout. • Working knowledge of GCP, with hands-on experience in IAM, organization policy, deny policies, audit logging, and GKE. • Detection engineering, logging, and incident response practices at scale. • Observability fundamentals: metrics pipelines, SLI and SLO definition, and alert design, with Prometheus, Grafana, or OpenTelemetry. • Penetration testing. • Experience working in multi-vendor environments. • Policy-as-code tooling (Open Policy Agent/Rego, Kyverno, Cloud Custodian). • Cloud security posture management tooling (Wiz, Prisma Cloud, Orca, Prowler). • PKI and certificate lifecycle. • Cilium, eBPF, Envoy, and the Kubernetes Gateway API. • Distributed job scheduling. • Collaboration & Communication • Partner with product, engineering, and leadership to shape security strategy and align technical direction with business outcomes • Translate complex security tradeoffs, risks, and opportunities into clear narratives that drive decision-making across technical and non-technical stakeholders • Lead security reviews and technical discussions, raising the bar for engineering rigor and constructive challenge across the team • Engage closely with engineering, data, and client teams to align security work with broader business priorities and measurable outcomes • Leadership & Influence • Define security architecture and engineering standards, bringing depth on tradeoffs, long-term implications, and responsible AI practices • Mentor and grow junior and mid-level engineers, multiplying impact through coaching, code reviews, and pairing on hard problems • Take ownership of the most ambiguous and highest-stakes pieces of work, driving them through to production with care for reliability, cost, and safety
Benefits
• At Robots & Pencils, we design AI systems for a human world. Our name says it all. Robots and pencils means engineering paired with creativity, because every agent we ship has to work for real people in real workflows. That balance is baked into how we operate. Every role here contributes directly to that mission. Here, you shape how AI systems integrate into enterprise operations, how teams move at real velocity, and how products create measurable impact for clients and the people they serve. We ship production-ready AI in 30 to 45 days. That pace demands people who take ownership, lead with craft, and care deeply about what they put their name on.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT