Job description

Jellyfish empowers engineering organizations to become as valuable and effective as possible by analyzing the data from tools and practices they already use. Our products help engineering leaders align their decisions with business initiatives and deliver software-- the right software, efficiently, and on time. We’re solving a real problem that people have today, and our growth is testament to the market potential. We are looking for a Staff Security Engineer to own and lead all Security Engineering activities at Jellyfish. In this pivotal role, you will define the vision, build the strategy, and scale our security engineering program. With a deep background in application security, automated vulnerability management, and SaaS platform security, you will be the ultimate technical authority for security across the organization. You will partner closely with engineering leadership to embed security into our DNA while continuing to stay hands-on by building security features and writing high-quality code. This is a unique opportunity to have complete ownership of security at a high-growth company. If this sounds exciting, we’d like to hear from you! WHAT YOU’LL DO: - Define Security Strategy & Roadmap: Own and drive the strategic security roadmap, aligning overarching security initiatives with executive business objectives and mitigating top-tier organizational risks. - Architectural Leadership: Own, design, and mandate scalable, resilient security architectures across our core infrastructure, platform, and product ecosystem. - Own the SDLC: Define, implement, and govern the Secure Development Lifecycle (SDLC) company-wide, pioneering automated threat modeling, continuous risk assessments, and secure development practices. - Secure AI Development & Governance: Partner closely with engineering and data science teams to establish and enforce secure development lifecycle (SDLC) practices specifically for both internal AI tools and customer-facing AI features. - AI Threat & Risk Modeling: Lead comprehensive threat modeling and continuous risk assessments tailored to artificial intelligence and machine learning ecosystems, mitigating unique risks such as prompt injection, data poisoning, and sensitive data leakage. - Drive Automation at Scale: Spearhead the overarching strategy and development for automated remedial workflows, comprehensive vulnerability management, and advanced software composition analysis solutions. - Mentorship & Cross-Functional Influence: Act as the definitive security leader, mentoring engineers, advising executive leadership on security posture, and cultivating a pervasive culture of security and inclusion. - Lead Threat & Incident Management: Direct the organizational response for critical security incidents, oversee manual and automated threat modeling, and dictate the strategy for pentesting and bug bounty programs. ABOUT YOU: - Extensive, proven track record of owning, building, and scaling application security programs in a SaaS or fast-paced startup environment. - Deep technical expertise in software engineering (e.g., Python, JavaScript/TypeScript, Rust, C/C++) combined with architectural-level understanding of reliability, safety, and security. - Deep understanding of the unique security challenges presented by Artificial Intelligence and Large Language Models (LLMs), with practical experience securing both internal AI infrastructure and customer-facing AI applications. - A forward-thinking approach to AI risk management, possessing the ability to balance rapid AI product innovation with rigorous security, compliance, and data privacy standards. - Demonstrated ability to drive cross-functional consensus, influence engineering leadership, and execute large-scale performance, testing, and security initiatives. - You possess strong business acumen, naturally balancing the needs of the user, product velocity, and enterprise security when dictating solutions. - You are a recognized expert who loves tackling complex research in computer security and sharing your knowledge through technical talks and engineering-wide education. - You thrive in autonomous environments, adept at identifying gaps, setting the direction, and executing with a distributed team. - You are eligible to work in the U.S. for any employer. - Located in EST or CST time zone (preferred). BONUS POINTS IF: - You bring expert-level skills with our technology stack and cloud environments (Python, Django, Postgres, AWS, Terraform, Circle CI/GitLab/GitHub Actions, Semgrep, LLVM). - You are a prominent voice or active contributor in open-source security projects, standardizations, or industry working groups (e.g., OpenSSF, Mozilla). - You have experience transforming the ways security and engineering teams collaborate, implementing cutting-edge tools to reduce friction and improve security posture. - You have led security at a high-growth startup before, and loved it. We believe that it takes a diverse team to build the best company we can. Jellyfish welcomes people from all backgrounds and especially encourages applications from members of groups underrepresented in the software industry. A list of job experiences and qualification requirements is great, but humility, a performance-driven attitude, and a team-player approach are most important to us. We love to have fun and win in the process. We only hire people who have a passion for building great companies in an environment where a sense of humor is a must. Occasional travel may be required. Applicants must be authorized to work for any employer in the US. We are unable to sponsor or take over sponsorship of an employment visa at this time. Let’s talk about us! This is all about you, but you want to know a little about us. Jellyfish jellyfish.co is the leading intelligence platform for AI-Integrated engineering, helping more than 1,000 companies including DraftKings, Keller Williams and Blue Yonder, leverage AI to transform how they build software. By combining the industry’s deepest engineering dataset with context-rich intelligence, Jellyfish helps R&D organizations understand what’s driving impact, adopt proven industry best practices, and make smarter decisions across AI adoption, planning, delivery, and engineering performance.

Requirements

Must-haves

If this sounds exciting, we’d like to hear from you!
Define Security Strategy & Roadmap: Own and drive the strategic security roadmap, aligning overarching security initiatives with executive business objectives and mitigating top-tier organizational risks.
Architectural Leadership: Own, design, and mandate scalable, resilient security architectures across our core infrastructure, platform, and product ecosystem.
Own the SDLC: Define, implement, and govern the Secure Development Lifecycle (SDLC) company-wide, pioneering automated threat modeling, continuous risk assessments, and secure development practices.
Drive Automation at Scale: Spearhead the overarching strategy and development for automated remedial workflows, comprehensive vulnerability management, and advanced software composition analysis solutions.
Mentorship & Cross-Functional Influence: Act as the definitive security leader, mentoring engineers, advising executive leadership on security posture, and cultivating a pervasive culture of security and inclusion.
Lead Threat & Incident Management: Direct the organizational response for critical security incidents, oversee manual and automated threat modeling, and dictate the strategy for pentesting and bug bounty programs.
Extensive, proven track record of owning, building, and scaling application security programs in a SaaS or fast-paced startup environment.
Deep technical expertise in software engineering (e.g., Python, JavaScript/TypeScript, Rust, C/C++) combined with architectural-level understanding of reliability, safety, and security.
A forward-thinking approach to AI risk management, possessing the ability to balance rapid AI product innovation with rigorous security, compliance, and data privacy standards.
Demonstrated ability to drive cross-functional consensus, influence engineering leadership, and execute large-scale performance, testing, and security initiatives.
You possess strong business acumen, naturally balancing the needs of the user, product velocity, and enterprise security when dictating solutions.
You are a recognized expert who loves tackling complex research in computer security and sharing your knowledge through technical talks and engineering-wide education.
You thrive in autonomous environments, adept at identifying gaps, setting the direction, and executing with a distributed team.
You are eligible to work in the U.S. for any employer.
You bring expert-level skills with our technology stack and cloud environments (Python, Django, Postgres, AWS, Terraform, Circle CI/GitLab/GitHub Actions, Semgrep, LLVM).
You are a prominent voice or active contributor in open-source security projects, standardizations, or industry working groups (e.g., OpenSSF, Mozilla).
You have experience transforming the ways security and engineering teams collaborate, implementing cutting-edge tools to reduce friction and improve security posture.
You have led security at a high-growth startup before, and loved it.
Occasional travel may be required.
Applicants must be authorized to work for any employer in the US. We are unable to sponsor or take over sponsorship of an employment visa at this time.
Let’s talk about us!

Nice-to-haves

Located in EST or CST time zone (preferred).

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aimachine learningpythonjavascripttypescriptrustpostgresaws

Platform: ashby
Effort: quick

Benefits

Benefits detected in the listing.

Vision