About the role
Application security makes the secure path the default path. We review designs and code across every venture, build the libraries and paved roads that developers pick up without thinking, and find the classes of bug that keep recurring: broken access control, injection, unsafe deserialisation and secrets written to logs. Our reviews are specific, so an engineer can fix the problem in one pass.
The bench spans Frontier AI, Autonomy & Sensing and Clexerl Go, and each has its own threat surface. Agent tool calls need authorisation checks that hold up when a model is persuaded to misuse a tool, and embedded firmware needs signed updates and memory-safe parsers. Findings from one venture feed a shared checklist, so a fix made in Calkulate protects a Clexerl Go service months later.
We work in the open. Threat models live beside the design doc, and security decisions are written down with their reasons so that they can be revisited when the facts change.
What you’ll do
- Run threat models on new designs with the owning team, and record the decisions and residual risks in the design doc.
- Review pull requests for authorisation, input handling and cryptographic misuse, with comments that explain the fix.
- Build shared libraries and CI checks, such as static analysis rules and dependency policy, that catch issues before merge.
- Define secure defaults for agent tool use, including scoped credentials, allow-lists and audit logging of every call.
- Triage findings from scanners, bug reports and penetration tests, and drive them to closure with clear owners and dates.
- Support SOC 2 control evidence for secure development, including change review and vulnerability management records.
- Teach secure coding through short workshops and worked examples drawn from real findings in our own code.
What you’ll bring
- Experience doing application security reviews or building secure development practice inside a product engineering team.
- Strong understanding of web and API vulnerabilities, including the OWASP Top 10 classes and their root causes in code.
- Working fluency in at least one backend language, such as Go, Python, TypeScript or Rust, read and written at production level.
- Practical knowledge of authentication and authorisation models, including OAuth 2.0, OIDC and fine-grained policy engines.
- Experience with static analysis, dependency scanning and secrets detection tools running in CI pipelines.
- The judgement to say when a risk is acceptable, and the clarity to explain why to an engineer who disagrees.
Nice to have
- Experience securing LLM applications against prompt injection, tool misuse and data exfiltration through model outputs.
- Background in memory-safety or firmware security for embedded or robotics systems.
- Experience writing custom static analysis queries or linters for a large codebase.
- Familiarity with supply-chain security frameworks such as SLSA, signed artifacts and reproducible builds.
Work you might take on
- 01
Ship a shared authorisation middleware that enforces tenant boundaries in every venture's HTTP services by default.
- 02
Build a CI rule that flags unsafe deserialisation and blocks merges until a reviewer signs off on the exception.
- 03
Design an agent tool-call gateway that scopes credentials per action and writes an immutable audit record for each call.
- 04
Run a secure-by-default template for new Clexerl Go services, with secrets handling and logging already configured.
Compensation
$240K – $380K
The US base salary range for this role. Every offer also includes equity in Clexerl and, when it spins out, in the venture you help build. We tell you the reasoning behind your number.
Benefits
Health, fully covered
Medical, dental and vision for you and your dependants, premiums paid in full.
Two kinds of equity
Equity in Clexerl, plus a stake in the venture you help build when it spins out.
22 weeks parental leave
Fully paid, for every parent, however your family arrives.
Rest that sticks
Flexible time off with a four-week minimum we actually check on, plus a company-wide week in December.
Learning and compute
A yearly budget for courses, conferences and books, and compute credits for side projects.
401(k) with a 4% match
Matched from your first paycheque and vested immediately.
How we hire
Apply 5 minutes
Send links to what you have built and a few lines on why this role. No cover letter needed.
Intro call 30 minutes
A conversation with the hiring manager about the work, the team and what you want next.
Work sample 2–4 hours
A paid take-home or a pairing session on a real-shaped problem. You pick the format.
Studio day One day
Meet the team, go deep on your work and ours. Remote or in person.
Offer Within 5 days
A written offer with the full range, the equity and the reasoning behind both.
Opens an email with a short template. Links beat résumés.