Posted today · be early
Staff Security Engineer
Refold AI
IndiaremotePosted today
R
Skill Required
Staff-Security-EngineerStaff-Security-EngineeringCloud-Security-EngineerStaff-Security-ResearcherSecurity-EngineerSenior-Information-Security-EngineerLead-Security-EngineerSecurity Engineersecuritysoftware engineeringSOCEngineeringTypeScriptPostgreSQLKubernetesISO 27001SalesforceCryptographyNode.jsbuildingMongoDBWorkdayPythondesignRedisAzureVaultCI/CDOWASPOAuthCloudRustHelmFulltime
Key highlights
- Required experience: Typically 8+ years in security or software engineering, including several years as senior security engineer for a multi-tenant SaaS platform.
- Notable requirement: Deep cloud and Kubernetes security experience; GCP and GKE preferred, strong AWS or Azure depth acceptable.
- Notable requirement: Hands-on Staff+ role writing code, reviewing designs, and leading incidents.
- Notable requirement: Represented a company's security to enterprise security teams and won their trust.
Role overview
You will set the security direction for the whole platform and build much of it with your own hands. This is a hands-on Staff+ role: you write code, review designs, and lead incidents, not only policy. Your mandate covers four things: protect customer credentials and data across a multi-tenant platform and every deployment model we ship; make AI agents safe to connect to enterprise systems, from prompt injection to tool-permission scope; harden how we build and ship, from the monorepo and CI to the images and Helm charts customers run in their own clusters; and turn security into a sales advantage by owning the technical side of enterprise security reviews and our compliance program. You will work across every engineering team, partner with product and go-to-market, and help hire and grow the security function.
Responsibilities
- Cloud and infrastructure security: Harden our GCP and GKE footprint: IAM, workload identity, network policy, egress control and private control planes.
- Cloud and infrastructure security: Own secrets and key management end to end, including rotation, short-lived credentials and KMS-backed encryption.
- Cloud and infrastructure security: Build runtime security for containers and nodes, so a compromised workload is detected and contained fast.
- Product and application security: Threat-model the integration engine, credential vault, workflow runtime and webhook surface, and drive the fixes.
- Product and application security: Guarantee tenant isolation across shared data stores, queues and workflow engines.
- Product and application security: Design safe execution for customer-authored code and custom actions.
- Product and application security: Raise the bar on authentication and access: SSO, SCIM, RBAC, API keys and OAuth flows.
- AI and agent security: Define how AI agents get scoped, auditable access to enterprise systems through our MCP servers and AI gateway.
- AI and agent security: Defend against prompt injection, tool misuse and data exfiltration through agents.
- Software supply chain: Secure the monorepo, CI pipelines and release process: branch protection, signed and provenance-attested images, SBOMs and dependency scanning.
- Software supply chain: Make the images and Helm charts that customers install in their own clusters trustworthy and easy to verify.
- Detection and incident response: Build logging, detection and alerting that catch real attacks, with low noise.
- Detection and incident response: Lead security incidents end to end: triage, forensics, containment, customer communication and the post-incident fix.
- Customer trust and compliance: Be the senior technical voice in enterprise security reviews, questionnaires and customer calls.
- Customer trust and compliance: Run SOC 2 and ISO 27001 as engineering work: automate evidence, own pen-test scoping and drive remediation.
- Customer trust and compliance: Publish hardening guidance for customers who self-host or run Refold in their own cloud.
- Leadership: Build paved roads so the secure way is the easy way for every engineer.
- Leadership: Mentor engineers, run a security-champions program, and help hire the security team.
Requirements
- Typically 8+ years in security or software engineering, including several years as the senior security engineer for a multi-tenant SaaS platform.
- Deep cloud and Kubernetes security experience. GCP and GKE preferred; strong AWS or Azure depth is fine.
- Strong application security: threat modelling, secure design review, and code review in at least one of TypeScript/Node.js, Python or Go.
- Fluency with OAuth 2.0, OIDC and SAML, secrets management, key management and encryption design.
- You have led real production security incidents, including forensics and customer communication.
- Hands-on software supply chain work: CI/CD hardening, artefact signing, SBOMs and dependency risk.
- You write production-quality code and ship tooling, not only recommendations.
- You have represented a company's security in front of enterprise security teams, and won their trust.
- You can turn SOC 2 or ISO 27001 controls into engineering systems instead of spreadsheets.
- Clear, direct writing. You explain risk to engineers, executives and customers in their own terms.
Nice to have
- Security work on LLM and agent systems: OWASP Top 10 for LLM applications, MCP, tool-use permissions.
- Sandboxing and isolation for untrusted code, such as gVisor, Firecracker or V8 isolates.
- Shipping software that customers run in their own environments: BYOC, on-prem, air-gapped.
- Securing workflow engines and data stores such as Temporal, MongoDB, Redis and PostgreSQL.
- Background in integration platforms, iPaaS, or enterprise systems like SAP, Workday or Salesforce.
- Offensive security experience, published research, CVEs or open-source security tooling.
- HIPAA or other regulated-data experience.
- You have built a security team from the first hire.
Additional details
- About Refold AI: Refold AI is the AI integration platform built for agents, made for modern SaaS companies that need to ship enterprise integrations at scale. We're reimagining integrations with AI agents that work like business consultants and integration engineers, building them 10x faster, in hours instead of days. The payoff: integrations stop being a bottleneck that costs you deals and burns margin, and become a growth engine. You win the enterprise deals that hinge on them, onboard faster, and scale without an army of consultants. We've grown rapidly, reaching seven-figure ARR and 30+ paying customers, powering the product and professional services teams at modern SaaS companies, from Incorta, Kantata, and Coupa to Highradius, Naehas, and OvationCXM. Refold AI has raised $6.5M from world-class investors including Eniac Ventures (early investors in Airbnb & Uber), Tidal Ventures, and Better Capital.
- Originally posted on Himalayas.