{"id":4300575,"url":"https://alion.io/job/curri-senior-security-engineer","title":"Senior Security Engineer","company":{"id":975,"name":"Curri","domain":"curri.com","url":"https://alion.io/company/curri","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":178000,"max":215000,"currency":"USD","period":"year","gross":null,"usd_annual":215000},"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AI Agents","optional":false},{"name":"Amazon EKS","optional":false},{"name":"AWS","optional":false},{"name":"Claude","optional":false},{"name":"Claude Code","optional":false},{"name":"Cursor","optional":false},{"name":"GraphQL","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Pulumi","optional":false},{"name":"React Native","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"AWS Bedrock","optional":true},{"name":"ISO 27001","optional":true},{"name":"JavaScript","optional":true},{"name":"Model Context Protocol","optional":true},{"name":"NATS","optional":true},{"name":"NIST AI RMF","optional":true},{"name":"OWASP","optional":true},{"name":"PostgreSQL","optional":true},{"name":"React.js","optional":true},{"name":"SIEM","optional":true}],"status":"live","first_seen_at":"2026-11-13T23:00:50Z","employer_posted_date":"2026-11-13","last_verified_at":"2026-11-14T02:59:50Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About the role:\nCurri is hiring its first dedicated Senior Security Engineer to join the Foundations team, which owns security, infrastructure, DevOps, and our AI engineering platform. Curri runs last-mile logistics for national retailers, industrial suppliers, and a growing list of Fortune 500 customers, and as we scale after our Series C, the security bar is rising fast. This is a builder role, not a monitoring role: you'll own security across our applications, cloud, and AI agents, write the tooling and guardrails that make the secure path the easy path, and be the person engineers, leadership, and customers trust to make the call on risk. As the first hire into this role, you'll shape how security works at Curri for years to come.\nWhat you will do:\nOwn application and cloud security end to end: threat modeling, secure design reviews, and hands-on work on sensitive code paths across our TypeScript/Node GraphQL API, React and React Native apps, Go services, and AWS/EKS infrastructure defined in Pulumi.\n\nBuild internal security tooling and guardrails instead of gates, such as authentication services, access proxies, secrets handling, policy-as-code, and CI checks that developers barely notice until they save them.\n\nSecure our AI-forward engineering platform. Curri runs autonomous agents that review, write, and deploy code; you'll own their access boundaries, credential handling, prompt-injection defenses, and audit trail, along with the policies for how staff use AI tools.\n\nTurn our security scanning (SAST, secrets, container, and IaC) into a program with signal: tune it, triage it, and drive findings to closure against clear SLAs.\n\nStand up detection and response: build high-signal alerting across cloud, identity, and application logs, lead security incidents, and make sure postmortem follow-through actually happens.\n\nRun the vulnerability lifecycle: scope and manage external penetration tests, validate and prioritize findings, partner with teams on fixes, and verify closure.\n\nPartner on compliance and customer trust: help run our SOC 2 program, answer enterprise security reviews, and turn what customers ask for into program improvements, not just questionnaire answers.\n\nRaise the security bar of the whole engineering team by mentoring engineers on secure design patterns, especially authorization, identity, and multi-tenant data isolation, and making security a normal part of how we ship.\n\nCommunicate risk clearly to engineers, executives, and customers in the terms that matter to each, and help shape the security roadmap as the function grows.\n\nWhat you need to have:\n8+ years of professional experience in software engineering and/or security, including at least 3 years focused on application, product, or cloud security.\n\nA track record of designing and building secure web applications, APIs, and internal tools. You read and write production code and are credible in a code review.\n\nDeep, hands-on knowledge of web and API vulnerabilities, especially authorization flaws (IDOR/BOLA), authentication and SSO (SAML, OIDC, JWT), SSRF, and injection, and how to find and fix them at scale.\n\nStrong cloud security experience in AWS and Kubernetes: IAM, network segmentation, workload isolation, secrets management, and infrastructure as code.\n\nExperience leading security incidents, ideally as the person in charge, with calm, diligent response and clear communication.\n\nThe ability to work as a team of one: you prioritize by real risk, make pragmatic tradeoffs, and ship without a playbook handed to you.\n\nFluency with AI-paired delivery (Claude Code, Cursor, or equivalent), and a clear view of the new risks AI agents and LLM-integrated apps introduce.\n\nStrong, direct communication with technical and non-technical stakeholders, and empathy for the developers and customers you're protecting.\n\nBonus points for:\nBeing an early or first security hire at a startup, and being able to speak to what you built first and why.\n\nDetection engineering experience implementing and maintaining a SIEM or detection-as-code pipeline.\n\nSecuring LLM applications or agentic systems, including familiarity with the OWASP LLM/Agentic Top 10, MCP, or AI governance frameworks like NIST AI RMF.\n\nExperience with SOC 2, ISO 27001, or enterprise customer security reviews.\n\nProven offensive skills, such as pentesting, bug bounty, or CTFs, used to assess real-world exploitability.\n\nExperience with our stack: TypeScript, Node, GraphQL, Postgres, Go, EKS, Pulumi, NATS.\n\nContributions to the security community through research, talks, open source, or writing.\n\nWhat is in it for you?\nThe chance to build Curri's security function from the ground up, with direct access to leadership and real authority over how we manage risk.\n\nHard, interesting problems: multi-tenant logistics data, enterprise SSO, a large GraphQL surface, and an AI agent platform that ships code to production.\n\nA genuinely AI-forward engineering culture where Claude, Claude Code, Cursor, and Bedrock are in daily use.\n\nCompetitive salary, equity compensation, and comprehensive benefits (health, dental, vision, 401K).\n\nWho are we?\nWe are Curri, and our mission is to build the network and software that move the world’s goods with speed, intelligence, and trust. Curri provides on-demand, last-mile logistics for construction and adjacent industries with our nationwide fleet of cars, trucks, and flatbeds.\nFounded in 2018 and part of the YC S19 Batch, we’re solving the massive inefficiencies that exist in the construction industry. Our headquarters are in Ventura, CA. Learn more at curri.com.\nCurri is an equal opportunity employer and complies with all applicable federal, state, and local fair employment practices laws. All qualified applicants will receive consideration for employment. We don't discriminate based on race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other characteristic protected by law.","description_format":"text","description_chars":5995,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Delivery","Logistics"],"lifecycle":[{"event":"open","at":"2026-11-14T02:59:50Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":25,"reasons":["conf:1","win:early"],"computed_at":"2026-11-14T04:24:44Z"},"pay":{"stated_usd_annual":215000,"is_top_pay":true},"html_url":"https://alion.io/job/curri-senior-security-engineer","json_url":"https://alion.io/job/curri-senior-security-engineer.json","meta":{"generated_at":"2026-11-14T04:24:44Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7060,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":975},"rest":"https://alion.io/mcp/rest/get_company?id=975"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcurri-senior-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcurri-senior-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcurri-senior-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/curri-senior-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcurri-senior-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4300575}},{"tool":"search_jobs","arguments":{"company":"curri.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4300575},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}