Security Engineer

A six-month contract to make the security page true. The four policy layers exist and their limits are written down; the hosted service is new and its controls are mostly a plan. You would turn the plan into evidence.

What you would do

• Write the threat model for an agent that runs shell commands on a developer's machine on behalf of a language model, and publish it.
• Design the enterprise controls — SSO, SCIM, audit export, allow-lists — so that they are checkable, and check them.
• Run the first third-party penetration test of the hosted service and own the fixes.
• Stand up the responsible-disclosure process and answer the first reports.

What we are looking for

• You have secured a product that other companies' security teams reviewed, and you have the scars.
• You can read the runtime's TypeScript and write the fix, not only the finding.
• You write clearly for two audiences at once: the engineer who ships the fix and the auditor who reads the report.

Process

A short note and links, a conversation with the runtime lead, a review of one policy layer's threat model as a paid exercise, a final conversation.