allium - Security Engineer
Requirements
• Typically 4+ years of relevant security, infrastructure, or software engineering experience, with direct responsibility for implementing security controls. • Hands-on experience with a major cloud platform and a strong foundation in identity, networking, operating systems, and access control. • Depth in at least two relevant areas, such as cloud security, detection and response, application security, vulnerability management, or corporate security. • Experience investigating technical problems from logs and system behavior, testing hypotheses, and following issues through to resolution. • Clear communication, practical judgment, and constructive working relationships with engineers and business teams. • DON'T TAKE OUR WORD FOR IT, WHAT OUR CUSTOMERS SAY ABOUT US (HTTPS://WWW.ALLIUM.SO/BLOG#LOVE) https://www.allium.so/blog#love • [https://app.ashbyhq.com/api/images/user-content/2f62de56-0dd0-4792-90f8-069c5cb51068/585a3023-4036-4ec0-af76-ed3198f80890/image.png] • WHAT SOME COOL PEOPLE HAVE TO SAY ABOUT US: • The Information's Top 50 Startups (https://www.allium.so/post/allium-named-to-the-informations-50-most-promising-startups-of-2025) • Mario Gabriele from The Generalist's Future 50 Startup List: https://www.allium.so/post/allium-named-awardee-of-the-generalists-inaugural-future-50-startups • Tomasz Tungus from Theory Ventures: https://tomtunguz.com/allium/ • Bucky Moore from Kleiner Perkins: https://www.kleinerperkins.com/perspectives/allium-series-a/ • OK, NOW FOR SOME TOUGH LOVE. HERE ARE THE VALUES WE STRIVE FOR AT ALLIUM: • Obsessiveness - The best people at Allium cannot put a problem down once they pick it up. We care more about the work than is strictly rational. Institutions trust us because our data is right. Right means caring about the small things. The decoded contract that ships with one wrong field. The label that is 99% accurate but wrong on the address that matters. The query that runs in 4 seconds when it should run in 400 milliseconds. Most companies tolerate these. We do not. • Obsessiveness shows up as depth of care. It is not measured in hours worked or visible effort. You should feel something physical when work ships half-right. That instinct is what we hire for. • Pro Athlete Mindset - Consistency. Day in and day out, in pursuit of excellence. A win yesterday does not guarantee (or even imply!) a win tomorrow. I hope anyone who supports a failing sports team will feel the pain (cough Man United fans) of inconsistency • Figure It Out & Extreme Ownership - Every day is unexplored territory. There are new engineering frameworks, new legal docs, new compliance, new sales, new regulations, and new operational procedures every single day. If you don’t know it, learn it. If you can’t learn it, find someone or a product that does it. If you can’t find someone, find someone who can find someone. It is never a lack of resources, but lack of resourcefulness. • High Agency - (One of) the highest commonalities between all successful people is their responsiveness. Most successful billionaire CEOs still reply to emails within minutes (within working hours). And when you reply, respond fast with effective solutions - and even better, resolutions. If you’re looking for a superpower, you can’t go wrong with responsiveness. Well of course this doesn't make sense when you're an engineer coding in flow, but in general high agency of problem solving gets one very far in life • Leading from the Front - No one is going to listen (and adopt) your suggestion unless you lead by example. It’s one thing to say We need to do XYZ this better & it’s another thing to build an MVP and say “This is the way we should do things”. The proof of work and momentum goes a long way.
Responsibilities
• Secure cloud infrastructure and access. Implement least privilege, phishing-resistant authentication, short-lived credentials, controlled privileged access, and reliable provisioning and deprovisioning. Improve cloud configuration, managed credential storage, and network protections with service owners. Improve secrets scanning and prevent credentials from entering source control. • Secure AI agents and developer tools. Help implement permissions, execution isolation, network restrictions, and audit trails for coding assistants, agents, and tool integrations, including MCP. Test how untrusted content could trigger prompt injection, tool misuse, or unintended data access, and build safeguards at the point where actions execute. • Build detection and response. Correlate identity, cloud, workload, and CI/CD telemetry to detect credential theft, unusual access, unauthorized agent actions, suspicious software changes, and data exfiltration. Investigate attacks across systems, reduce alert noise, and test response procedures with system owners, including session revocation, exposed-credential rotation, and removal of unauthorized access. • Reduce software supply-chain risk. Assess dependencies, CI/CD workflows, third-party integrations, and developer environments. Partner with engineers to validate findings, protect build and deployment credentials, and remediate vulnerabilities. • Move quickly on relevant threats. Maintain visibility into internet-facing services, including developer tools and management interfaces. Evaluate new vulnerabilities and active exploitation against our actual exposure. Help patch, isolate, revoke credentials, or apply compensating controls with service owners, then verify that the response worked. • Automate and document. Use code and APIs to improve access reviews, configuration checks, evidence collection, and remediation tracking. Use AI thoughtfully for security work, validating its output and protecting sensitive data. • Support employee security and enterprise assurance. Deploy, validate, and maintain endpoint protections and device security baselines, including prevention settings, tamper protection, encryption, and timely updates. Work with the owner of employee IT on identity and SaaS controls. Provide clear technical evidence for audits and customer reviews, and maintain useful runbooks.
Benefits
• Medical, Dental, Vision, Life and AD&D insurance - US folks get 100% coverage for Gold plans, 80% for dependents • Ownership - Meaningful early-stage equity. Every full-time employee receives a stock option grant so you can share directly in Allium's upside • Time off - Flexible, trust-based paid time off. We encourage people to take the rest they need. In every country we hire, our policies meet or exceed local statutory vacation requirements • Retirement - Company sponsored 401(k) plan in US so you can save pre-tax for the long term • All applicants have to answer this pop quiz: "What is an Allium? What is your favorite Allium? https://www.allium.so/post/how-allium-got-its-name". Bonus points for the right pronunciation.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT