You earn the right to hold a person's most sensitive information, and you do it by making protection, consent and recovery part of every engineering decision rather than a review at the end. You own the threat model across hardware, software, people and external agents, plus release criteria, incident response and vulnerability handling.
Open for applications. Starts at: First team.
We are taking applications for this role now and building the pipeline for it. The stage above is when the work itself is expected to begin, which is something you deserve to know before you apply rather than after. It is context, not a gate.
Where
In the office together five days a week, in one of our garages, and remote-friendly around your family, arranged one person at a time. We hire across the United States 🇺🇸, India 🇮🇳 and the UAE 🇦🇪.
The work
Own the threat model across hardware, software, people and external agents. Define release security criteria, incident response and vulnerability handling. Review key custody, authentication, authorization, update integrity and data deletion with the engineers who build them.
The milestone
In your first 90 days, establish the security architecture, test the highest-risk boundaries and run an incident and device-loss recovery exercise.
Required
Nice to have
Evidence
Bring hands-on security engineering and experience making clear decisions under uncertainty. You should be able to teach threat modeling, review cryptographic system design and work constructively with product teams.
Evidence, not credentials. We are describing work you can point at, in whatever form it exists.
The exercise
Threat-model a household with separate users, an untrusted plugin and a stolen device; explain what remains at risk.
The package
Indicative pay ranges by market and level are on the compensation page. Plan numbers are confirmed in your offer letter.
Apply
One short form. A person reads every application and you hear back either way. You will get your own link to check where things stand, and you can withdraw or delete your application from it at any time, without an account.
