litellm - Senior Security Engineer

• APPLICATION SECURITY • Conduct deep security reviews of LiteLLM’s Python proxy, APIs, authentication systems, and enterprise features. • Identify and remediate vulnerabilities involving authentication, authorization, secrets, tenant isolation, injection, and data exposure. • Partner directly with engineers throughout design, implementation, code review, and release—not only after code is shipped. • Build application-security tooling into the development lifecycle, including SAST, DAST, dependency scanning, and secrets detection. • Perform internal red teaming and adversarial testing against LiteLLM’s APIs, proxy, and LLM-specific attack surfaces. • Threat-model new products and architecture changes before they reach production. • Create secure coding guidelines and train engineers on common vulnerabilities and defensive practices. • INFRASTRUCTURE, CI/CD, AND SUPPLY-CHAIN SECURITY • Harden LiteLLM’s Docker images, PyPI packages, GitHub Actions workflows, and release infrastructure. • Detect dependency confusion, poisoned packages, compromised dependencies, exposed secrets, and unsafe build practices. • Implement SBOMs, signed builds, provenance checks, and reproducible-build practices. • Design secure-by-default configurations for cloud and self-hosted deployments, including authentication, IAM, secrets management, and key rotation. • Review cloud infrastructure, network boundaries, access controls, and production deployment patterns. • IT SECURITY AND INCIDENT RESPONSE • Strengthen employee identity, device, SaaS, and internal access controls. • Build monitoring and anomaly detection for suspicious API, model, authentication, and routing activity. • Lead security incident response, vulnerability assessment, remediation, post-mortems, and stakeholder communication. • Establish formal vulnerability intake, CVE triage, disclosure, and remediation processes. • Maintain threat models as LiteLLM’s product and architecture evolve.