SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
LiveKit is building infrastructure for voice-driven AI computing. The platform powers voice AI applications for OpenAI, xAI, Salesforce, Coursera, Spotify, and thousands of others, facilitating billions of calls annually.
You will join a small Trust team (security, IT, compliance) to build and run LiveKit's vulnerability management and security operations program from the ground up. This is an early-stage program where you will own end-to-end ownership from day one.
Key responsibilities:
- Select, deploy, and operationalize scanning tooling across production assets
- Run vulnerability management end-to-end: triage, severity assessment in the company's environment, owner assignment, remediation SLAs, and reporting
- Build engineering-first triage and remediation workflows that integrate with how engineering teams already work; automate routing and follow-up
- Create a remediation dashboard that engineering and leadership use to track and act on findings
- Automate collection of vulnerability management evidence for compliance programs in partnership with the Compliance team
- Build automation and agentic tooling to eliminate manual security operations work and scale with engineering growth
You will translate security concerns into engineering action, set real severity levels for findings using CVSS as one input, and take a pragmatic approach to risk mitigation. The role requires both builder and breaker mentality, understanding security from first principles, and the ability to explain complex technical concepts clearly.
LiveKit's customers trust the platform with audio, video, and data belonging to their end users, so security failures directly impact customer data and business continuity.
REQUIREMENTS:
- 5+ years in security engineering, security operations, or software engineering with significant focus on security
- Hands-on experience building or running a vulnerability management program or software security tooling (SCA, container, cloud, or host scanning)
- Engineering-first approach to triage and remediation; ability to make fixes easy to ship
- Judgment to set real severity in the company's environment using CVSS as one input
- Strong scripting and automation skills in Go or Python; comfort reading infrastructure as code (Terraform)
- Pragmatic approach to risk; ability to explain why findings matter to the business and remediation timelines
NICE TO HAVE:
- Experience with real-time media, networking, or WebRTC systems
- Experience supporting compliance audits (HIPAA, PCI-DSS, ISO 27001, SOC 2)
- Incident response or application security experience
- AI security experience (securing LLM applications or agent infrastructure)
