[Hiring] Senior Security Engineer @Curri

Role Description

Curri is hiring its first dedicated Senior Security Engineer to join the Foundations team, which owns security, infrastructure, DevOps, and our AI engineering platform. This is a builder role, not a monitoring role: you'll own security across our applications, cloud, and AI agents, write the tooling and guardrails that make the secure path the easy path, and be the person engineers, leadership, and customers trust to make the call on risk. As the first hire into this role, you'll shape how security works at Curri for years to come.

• Own application and cloud security end to end: threat modeling, secure design reviews, and hands-on work on sensitive code paths across our TypeScript/Node GraphQL API, React and React Native apps, Go services, and AWS/EKS infrastructure defined in Pulumi.
• Build internal security tooling and guardrails instead of gates, such as authentication services, access proxies, secrets handling, policy-as-code, and CI checks that developers barely notice until they save them.
• Secure our AI-forward engineering platform, owning access boundaries, credential handling, prompt-injection defenses, and audit trails.
• Turn our security scanning (SAST, secrets, container, and IaC) into a program with signal: tune it, triage it, and drive findings to closure against clear SLAs.
• Stand up detection and response: build high-signal alerting across cloud, identity, and application logs, lead security incidents, and ensure postmortem follow-through.
• Run the vulnerability lifecycle: scope and manage external penetration tests, validate and prioritize findings, partner with teams on fixes, and verify closure.
• Partner on compliance and customer trust: help run our SOC 2 program, answer enterprise security reviews, and turn customer requests into program improvements.
• Raise the security bar of the whole engineering team by mentoring engineers on secure design patterns.
• Communicate risk clearly to engineers, executives, and customers, and help shape the security roadmap as the function grows.

Qualifications

• 8+ years of professional experience in software engineering and/or security, including at least 3 years focused on application, product, or cloud security.
• A track record of designing and building secure web applications, APIs, and internal tools.
• Deep, hands-on knowledge of web and API vulnerabilities, especially authorization flaws, authentication and SSO, SSRF, and injection.
• Strong cloud security experience in AWS and Kubernetes: IAM, network segmentation, workload isolation, secrets management, and infrastructure as code.
• Experience leading security incidents, ideally as the person in charge, with calm, diligent response and clear communication.
• The ability to work as a team of one: prioritize by real risk, make pragmatic tradeoffs, and ship without a playbook handed to you.
• Fluency with AI-paired delivery and a clear view of the new risks AI agents and LLM-integrated apps introduce.
• Strong, direct communication with technical and non-technical stakeholders, and empathy for the developers and customers you're protecting.

Requirements

• Bonus points for being an early or first security hire at a startup.
• Detection engineering experience implementing and maintaining a SIEM or detection-as-code pipeline.
• Securing LLM applications or agentic systems, including familiarity with the OWASP LLM/Agentic Top 10.
• Experience with SOC 2, ISO 27001, or enterprise customer security reviews.
• Proven offensive skills, such as pentesting, bug bounty, or CTFs.
• Experience with our stack: TypeScript, Node, GraphQL, Postgres, Go, EKS, Pulumi, NATS.
• Contributions to the security community through research, talks, open source, or writing.

Benefits

• The chance to build Curri's security function from the ground up, with direct access to leadership.
• Hard, interesting problems: multi-tenant logistics data, enterprise SSO, a large GraphQL surface, and an AI agent platform.
• A genuinely AI-forward engineering culture where Claude, Claude Code, Cursor, and Bedrock are in daily use.
• Competitive salary, equity compensation, and comprehensive benefits (health, dental, vision, 401K).

Company Description

We are Curri, and our mission is to build the network and software that move the world’s goods with speed, intelligence, and trust. Curri provides on-demand, last-mile logistics for construction and adjacent industries with our nationwide fleet of cars, trucks, and flatbeds.

Founded in 2018 and part of the YC S19 Batch, we’re solving the massive inefficiencies that exist in the construction industry. Our headquarters are in Ventura, CA.