{"id":3839832,"url":"https://alion.io/job/gelato-senior-security-engineer","title":"Senior Security Engineer","company":{"id":6176,"name":"Gelato","domain":"gelato.com","url":"https://alion.io/company/gelato","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Stockholm, Sweden","Lahore, Pakistan"],"countries":["SE","PK"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Function Calling","optional":false},{"name":"GCP","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"SIEM","optional":false},{"name":"TypeScript","optional":false},{"name":"LLM","optional":true},{"name":"OWASP Top 10","optional":true}],"status":"live","first_seen_at":"2026-11-05T19:00:48Z","employer_posted_date":"2026-11-05","last_verified_at":"2026-11-07T22:04:46Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"About Gelato\nGelato runs the world’s largest network for on-demand production of customized products, from t-shirts and wall art to mugs, books and cards. We’re an AI-first, cloud-native platform with zero physical assets:\nGelatoCreate connects e-commerce businesses to 250+ partners across 32 countries, reaching over 5 billion people in under 72 hours.\n\nGelatoConnect, our AI-driven print production OS, runs producers’ operations end to end, covering procurement, workflow and logistics.\n\nOptimalprint, where Gelato began, is our consumer brand in 20+ markets, helping millions of customers create personalised cards, wall art and gifts, online and through its app.\n\nTogether they sit between thousands of merchants, our production partners and millions of customers. Every order carries someone’s data, designs and brand.\nAI at the Core\nWe are not just early adopters of AI - we’re AI-native builders, and security is no exception.\nAI is how we work. Engineers use LLMs for code generation, testing and documentation, and autonomous agents drive platform resilience, observability, cost control and internal workflow automation. Our security team works the same way, with LLMs and agents handling alert triage, threat summaries, runbooks and response orchestration.\n\nAI is also what we protect. AI agents already run inside GelatoConnect and our core platform. They map product catalogues, validate file uploads, and even write and deploy integration code. Agents with that kind of reach raise new questions about tool permissions, prompt injection and data flows, and you’ll make sure what they build is secure without slowing our teams down.\n\nThe Role\nThis isn’t an analyst role where you watch dashboards and send findings back. Our engineers now ship many times more than they used to with AI, so reviewing their work by hand doesn’t scale. You’ll build the agents and automation that review alongside them, make sure the agents engineering builds are secure too, and act as the bridge between information security and engineering.\nYou’ll join a small information security team, reporting to [our Head of Information Security], and work across application security, cloud and identity, and detection and response. You don’t need to be an expert in all of it. If you’re strong in a few of these areas and keen to grow into the rest, we’ll help you get there.\nWhat You’ll Do\nAutomate with AI: build and operate agents for code and change review, alert triage, finding validation, investigation summaries and routing to owners. You’ll connect them safely to internal systems with least privilege, audit logs and human approval for risky actions. You’ll measure them honestly (accuracy, false-positive rate, time saved, what a human had to correct) and retire the ones that don’t earn their keep.\n\nSecure the SDLC: own SAST, SCA, secret, container and IaC scanning, tuned so engineers trust the signal. Threat-model new services and AI features early, including the agents engineering builds, and build paved-road defaults (libraries, templates, CI checks) so common vulnerability classes become hard to introduce.\n\nSecure Cloud and Identity: assess and audit cloud and container platform security, including least-privilege IAM, preventative guardrails, cluster hardening, runtime detection and the infrastructure as code behind it. Our Platform team owns implementation. You’ll also manage identity provider roles, clients and access reviews, and keep authentication and authorisation consistent across services.\n\nDetect and Respond: monitor through our SIEM, scan our attack surface, and lead incidents end to end: containment, investigation, communication, and a blameless write-up whose fixes actually land. Write response playbooks that agents run for the routine steps and that escalate to a person, with the work already done, when judgement is needed. Hunt proactively, feed what you find back into detections and guardrails, and share an on-call rotation.\n\nPartner with Engineering: explain risk plainly to engineers, product and leadership, and give prioritised, concrete fixes rather than a list of findings. Make security decisions visible by writing down the reasoning, the trade-off, and what we chose not to do.\n\nWhat We’re Looking For\n5+ years in security engineering, AppSec, cloud security or incident response\n\nAn AI-native way of working: hands-on experience building with LLMs (agents, tool calling, RAG or MCP), knowing where they fail, and using AI tools every day. This is a hard requirement.\n\nHands-on experience securing a major public cloud (AWS preferred, but Azure or GCP works too), Kubernetes and infrastructure as code, plus solid web, API, OAuth 2.0 / OIDC and IAM fundamentals\n\nSolid foundations in application security, the secure SDLC and incident response, with deep expertise in some of them\n\nProduction-quality code in Python, Go or TypeScript, and a habit of automating over repeating\n\nThe ability to earn engineers’ trust with plain explanations, practical fixes and pragmatic trade-offs\n\nFluent written and spoken English\n\nNice to Have\nOffensive security: pentesting, bug bounty, CTFs or published research\n\nAI red-teaming or OWASP Top 10 for LLM Applications\n\nThreat hunting, forensics or malware analysis\n\nHands-on experience with SIEM and SOAR / workflow automation platforms\n\nExperience running an open-source identity provider, Kubernetes runtime security or policy-as-code\n\nOSCP, OSWE, GCIH or cloud security certifications (a plus, never a requirement)\n\nWhat it's like to work at Gelato\nWe are a customer-obsessed team with the ambition to change the world by connecting technology to the printing industry and making it much more sustainable. Everyone who joins our team must feel genuinely intrigued and motivated by our mission. We expect a lot. We are a driven team with big goals, so we seek individuals who are genuinely passionate about their work and possess an entrepreneurial spirit. Our culture is unique and we live by our values, so it's worth learning more about our culture and how we work before presenting your application.\nAt Gelato, we pride ourselves on our global presence with 11 offices worldwide, fostering a dynamic and diverse work environment. Rooted in a culture that values collaboration, creativity, and camaraderie, we actively cultivate a company culture that thrives on shared experiences. We encourage team members to embrace this culture by working from our office spaces at least three days a week, allowing for meaningful connections and collective growth.\nLastly, we ask that you please upload your CV in English, regardless of which country you are applying from.\nCandidate Information\nAs part of our commitment to a transparent recruitment process, please be aware that following acceptance of an offer of employment with Gelato, you will be asked to complete a background check conducted by a third-party provider.","description_format":"text","description_chars":6909,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Pakistan","iso":"PK","kind":"country"},{"name":"Sweden","iso":"SE","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["E-commerce Platforms","Contract Manufacturing"],"lifecycle":[{"event":"open","at":"2026-11-05T22:15:33Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":69,"reasons":["conf:0","win:early"],"computed_at":"2026-11-07T05:47:08Z"},"pay":null,"html_url":"https://alion.io/job/gelato-senior-security-engineer","json_url":"https://alion.io/job/gelato-senior-security-engineer.json","meta":{"generated_at":"2026-11-08T01:37:01Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":3565,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6176},"rest":"https://alion.io/mcp/rest/get_company?id=6176"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgelato-senior-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgelato-senior-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgelato-senior-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/gelato-senior-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgelato-senior-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3839832}},{"tool":"search_jobs","arguments":{"company":"gelato.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3839832},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}