SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 200,000 - 250,000 / annual
InstaLILY is an AI products and infrastructure company building Lily™, the world's first AI Forward Deployed Engineer. Lily learns how businesses work, builds software they need, and goes live in days—then stays to keep systems running as the business changes. The company has raised nearly $100M, achieved 5x revenue growth, and serves leading enterprises in construction, industrial distribution, logistics, and healthcare.
You will be InstaLILY's first dedicated security leader, reporting directly to the CEO. This is a player-coach role where you'll spend 30–50% of your time writing code (automation, infrastructure-as-code, security tooling, remediation PRs) and the remainder on threat-modeling, architecture review, cloud and IAM hardening, and enterprise customer engagement (roughly 25–30% on CISO calls, audits, and security reviews).
Key responsibilities include:
**Customer Trust & Compliance:** Run enterprise security reviews end-to-end. Build a single source of truth for security answers, launch a trust center and security package, and lead CISO and InfoSec calls, audits, and RFP security sections. Keep SOC 2 Type II and HIPAA healthy in Drata with continuous control monitoring, policy refreshes, and access reviews. Lead the next audit window and stand up a GDPR program.
**Cloud & Agent Security:** Partner with SRE to prioritize and close critical and high cloud findings. Make org-level guardrails the default: org policies, secrets management, and least-privilege IAM across GCP and AWS. Build security into Lily from the start: threat models, prompt-injection defenses, tenant isolation, agent authorization, and security checks in CI as part of a secure SDLC.
**Testing & Response:** Commission and run an independent pen-test program and drive remediation. Refresh the incident response plan, run tabletop exercises, and serve as the escalation point for security incidents.
**Identity & Foundations:** Complete SSO (Okta) coverage for tier-1 apps, run quarterly access reviews, and implement device management (MDM).
**Strategy & Growth:** Decide whether to partner with a vCISO or GRC service, complete the CNAPP evaluation, and deliver a 12-month security roadmap to the CEO. Hire and lead 1–2 security or AppSec engineers as the program scales.
The company runs a multi-tenant platform with hundreds of cloud services across GCP (primary: Cloud Run, Cloud SQL, GKE) and AWS (secondary: EKS), with customer deployments also on Azure. The stack includes Kubernetes, OpenTofu, Postgres, TypeScript/Next.js, Python, Okta, WorkOS, Drata, Datadog, Grafana, Sentry, and Cloudflare. You'll secure this infrastructure at a company of roughly 100–150 people.
Success in year one means: clean SOC 2 Type II and HIPAA renewal with no exceptions and ≥95% of controls passing continuously; security questionnaires returned in 3 business days or less; annual independent pen test completed with critical findings remediated within SLA; critical and high cloud findings closed with secure-by-default guardrails enforced; SSO on all tier-1 apps, quarterly access reviews, and MDM in place; AI and agent security built into the platform; and a GDPR program running with a clear decision on ISO 27001 and HITRUST.
**Requirements:**
- 8+ years in security engineering, including hands-on ownership of a security or compliance program at a SaaS company, ideally at Series B–C stage
- Hands-on cloud and AppSec depth: strong in GCP and AWS IAM, Kubernetes, and infrastructure-as-code (Terraform/OpenTofu); ability to threat-model multi-tenant, multi-cloud architecture and review code
- Builder mindset: write production-quality Python or TypeScript and ship your own automation, tooling, and fixes
- End-to-end SOC 2 Type II ownership: run the program yourself (audits, controls, evidence, GRC tooling); HIPAA experience is a strong plus
- Credibility with enterprise CISOs: led customer security reviews, questionnaires, and audits; can hold your own with Fortune 500 security teams
- Real LLM experience: built something real with LLMs and understand how agentic systems change the threat model
- Player-coach mindset: energized by doing the work yourself; tech-lead or program-lead experience sufficient; formal people management a plus, not required
- In-person availability: 5 days/week in New York or San Francisco office
**Bonus:** Built a security function from scratch at Series B/C SaaS and taken it through SOC 2 Type II; secured an LLM or agent product in production; led real incident response; experience with multi-tenant isolation, pen-test programs, Okta/IdP rollouts, CNAPP tooling (Wiz, Aikido); familiarity with GDPR, ISO 27001, HITRUST, NIST CSF, EU AI Act; certifications (CISSP, CCSP, GCP Professional Cloud Security Engineer, AWS Security Specialty, OSCP); public work (talks, writing, open-source security tooling).
