[Hiring] Staff Security Engineer @Hops

Role Description

We’re looking for a hands-on Senior or Staff Security Engineer to lead and own security across the company. This role involves:

• Hardened cloud infrastructure
• Least-privilege access
• Secure delivery
• Vulnerability management
• Penetration testing
• Incident response

The threats in this space are increasing exponentially. Our product runs agents that read untrusted content, execute code, and hold credentials. Attackers now use AI to probe and fuzz faster than before, posing real risks such as:

• Prompt injection
• Data exfiltration through allowed channels
• Cross-session access
• Insecure agent-written code reaching production

We want someone who will help us close the obvious gaps without being asked and finds the problems nobody has written down yet. You'll work closely with our ITOps, platform, and product engineers. Your job is to improve our security posture without slowing delivery by:

• Building automated controls into existing workflows
• Testing whether those controls hold
• Addressing critical risks
• Taking responsibility for security outcomes

This is a hands-on role - you'll be in the code, infra, and pipelines yourself.

Qualifications

• Strong application security background - you can spot exploitable flaws and explain the fix
• Hands-on penetration testing and offensive security experience across web applications, APIs, and cloud infrastructure
• Solid infrastructure and cloud security fundamentals: IAM, network segmentation, containers and isolation, secrets management, logging
• Experience building detections and running incident response, not only reviewing them
• Real fluency with AI coding agents and LLM-based systems - how they work, where they fail, and how they can be manipulated
• Enough software engineering skill to build your own tooling, automation, and test harnesses
• Sound judgment under pressure: you can weigh a risk against a release, decide, and explain the decision to engineers and founders

Requirements

• Experience securing sandboxed or multi-tenant code execution environments (Nice to Have)
• Red-team, bug bounty, or CTF track record (Nice to Have)
• Experience with security programs and compliance frameworks (ISO 27001, SOC 2) in a small company (Nice to Have)

Benefits

• Impact: Be at the forefront of AI reshaping how work gets done
• AI-First: Use AI to expand what one person can accomplish
• Ownership: Small team with real scope, autonomy, and equity
• High Talent Density: Work directly with senior teammates and our founder in a flat structure
• Remote-First: Hire globally, prioritizing talent over location