Job description

About Nuvo We’re Redefining the $11T B2B Commerce and Payments Market Nearly everything you buy, from food to medicine, from building materials to auto parts, passes through a chain of businesses before it reaches your hands. But every handoff between them still runs on paperwork, phone calls, and spreadsheets. Nuvo is building the agentic commerce network to bring global trade online: shared infrastructure for everything from verification to invoicing to payment, with AI agents that can automate routine tasks so humans can focus on judgment. With 200k+ businesses already run on the Nuvo network today, and backed by $45M from Sequoia, Spark, Founders Fund, and Index, we're building the operating system for global commerce. About the Role We are looking for a lead security engineer to stand up and own security at a company building category-defining products. Our problems span safe deployment of AI agents, multi-party workflow automation, identity, risk, and large-scale data, and because we handle sensitive financial information for businesses across the economy, trust is the product. As our first dedicated security hire, you'll define what good looks like: shaping the roadmap, embedding security into how we build, and protecting our customers and their data from day one. Since we’re an early startup, you’ll have to be prepared to wear many hats; most of your time will be spent on application and product security, but you'll also reach into cloud infrastructure, detection and response, and compliance as the work demands. Your impact will be felt across team culture, our customers, and the economy. What You’ll Do: • Own application and product security end to end — threat modeling, secure design and code review, and partnering with engineers to ship features that are secure by default rather than secured after the fact. • Build the security function from the ground up: set the roadmap, establish best practices, choose the tooling, and define the standards the rest of engineering will build on. • Find, prioritize, and drive remediation of vulnerabilities across the product and our infrastructure and build the guardrails that keep them from coming back. • Reach across the stack as needed — cloud and infrastructure hardening (IAM, secrets, network, Kubernetes), logging, detection and incident response, and the security foundations behind compliance efforts like SOC 2. • Make security a part of engineering culture, to help the whole team move fast but securely. Write and review high-quality code, contribute to the systems you protect, and level up the team around you. • Use the best tools for the job. We've used technologies like Vue, GraphQL, and even built our own DSL for defining roles and permissions. What matters most is the impact you create and the risk you reduce, not the specific tools you use. What You Bring: • 5+ years in security engineering, with deep application/product security expertise and the range to operate across cloud, infrastructure, and detection when needed. • A track record of building or substantially shaping a security program. You should be comfortable being the one who decides what to do first and why. • Strong engineering fundamentals: you read and write production code, and you can earn the trust of the engineers you partner with. • Strong problem-solving skills and the ability to communicate technical risk clearly to engineers, to leadership, and to customers. • A passion for internet technologies and a sharp instinct for how modern systems get attacked and defended. • Experience working in an early-stage engineering team or a fast-growing company, solving hard, ambiguous problems with a strong bias for action. Expected Compensation Range $200,000-$300,000

Requirements

Must-haves

Own application and product security end to end — threat modeling, secure design and code review, and partnering with engineers to ship features that are secure by default rather than secured after the fact.
Build the security function from the ground up: set the roadmap, establish best practices, choose the tooling, and define the standards the rest of engineering will build on.
Find, prioritize, and drive remediation of vulnerabilities across the product and our infrastructure and build the guardrails that keep them from coming back.
Reach across the stack as needed — cloud and infrastructure hardening (IAM, secrets, network, Kubernetes), logging, detection and incident response, and the security foundations behind compliance efforts like SOC 2.
Make security a part of engineering culture, to help the whole team move fast but securely. Write and review high-quality code, contribute to the systems you protect, and level up the team around you.
5+ years in security engineering, with deep application/product security expertise and the range to operate across cloud, infrastructure, and detection when needed.
A track record of building or substantially shaping a security program. You should be comfortable being the one who decides what to do first and why.
Strong engineering fundamentals: you read and write production code, and you can earn the trust of the engineers you partner with.
Strong problem-solving skills and the ability to communicate technical risk clearly to engineers, to leadership, and to customers.
A passion for internet technologies and a sharp instinct for how modern systems get attacked and defended.
Experience working in an early-stage engineering team or a fast-growing company, solving hard, ambiguous problems with a strong bias for action.
Expected Compensation Range $200,000-$300,000

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

airestkubernetesvuegraphql

Platform: gem
Effort: medium