[Hiring] Senior Security Platform Engineer @Ashby

Role Description

We’re looking for a platform engineer to build the secure-delivery capabilities other engineers use every day. You’ll turn security requirements into reliable integrations, useful feedback, and self-service workflows that work across our production repositories.

You’ll treat engineers as your users and own the operation of what you ship. You’ll use existing tools where they fit and build the capabilities that materially improve our delivery workflow.

Your mission is to make our delivery pipeline secure by default across application code, infrastructure, dependencies, containers, and product configuration. You’ll own the technical implementation and operation of delivery-security tooling and controls, including integration, configuration, tuning, reliability, and coverage.

In practice, you’ll:

• Deploy, configure, integrate, and tune static analysis, dependency, secret, container, and Infrastructure as Code scanning in our CI/CD workflows.
• Inventory production repositories and delivery paths, including prompts and model configuration.
• Make scanner coverage distinct from application-specific tests of AI behavior; AppSec defines those tests, and you operate agreed delivery checks.
• Start new checks in report-only mode where appropriate, then implement agreed warn and block policies using exploitability, exposure, and compensating controls.
• Give engineers self-service exceptions within documented rules, with an owner, justification, expiry, and audit trail.
• Escalate decisions outside those rules to Security leadership with the relevant specialist analysis.
• Build automation and AI-assisted workflows that enrich findings, propose fixes, and support Product Engineering’s triage under documented criteria.
• Preserve required checks, review, and rollback for automated patch changes.
• Make coverage, integration failures, finding age by risk, time to triage and remediate, false blocks, build delay, and bypasses visible.
• Record mitigations separately from completed fixes and connect useful telemetry to GRC evidence.
• Work with Infrastructure on cloud-posture monitoring, useful critical-misconfiguration alerts, and bounded remediation automation.
• Extend into shared-image hardening and artifact provenance as the delivery foundations mature.

To ground it with examples, you could:

• Roll out secret scanning with push protection and make a blocked push understandable and actionable for an engineer.
• Turn a repeated scanner-exception request into a PR workflow with a reason, expiry, and evidence for revisiting it.
• Reproduce a dependency issue in the application, add a regression check, and build a workflow that proposes a patch with useful evidence.
• Show which delivery paths are covered, where checks fail, and whether enforcement is addressing risk while keeping build delays reasonable.

Qualifications

• You’ve built and operated CI/CD, developer tooling, or infrastructure automation used by other engineers.
• You can write maintainable code, explain the failure modes of what you shipped, and use security evidence to make a practical rollout decision.
• Supply-chain and scanner experience is useful; you can learn individual tools as part of the work.
• You’ve applied AI in engineering and can explain how you check its outputs and permissions.
• You enjoy treating engineers as users, making build-versus-buy decisions, and improving adoption and reliability after launch.

Requirements

• You might not enjoy the role if you prefer to deliver a prototype and hand off its operation.
• You prefer a prescribed backlog to investigating an ambiguous problem, writing a proposal, and bringing partners into the work.
• You want standalone assessments to be your main output. This role centers on working delivery capabilities and their adoption.

Benefits

• Competitive salary and equity.
• 10-year exercise window for stock options. You shouldn’t feel pressure to purchase stock options if you leave Ashby — do it when you feel financially comfortable.
• Unlimited PTO, and we will encourage you to take it.
• A minimum of 12 weeks of fully paid parental leave, covered by Ashby. The actual number may increase to satisfy local requirements.
• Generous equipment, software, and office furniture budget. Get what you need to be happy and productive!
• $100/month education budget with more expensive items (like conferences) covered with manager approval.
• If you’re in the US, we offer top-tier health insurance for you and your dependents, with 100% of premiums covered by Ashby.
• In other countries, we provide high-quality supplemental health insurance for you and your dependents, also fully covered by us.