SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Sandbar is building Stream, a private voice ring and conversational interface designed as a self-extension for human thinking. The company is based in New York City and has assembled a team with deep experience from Meta, CTRL-labs, Google, Apple, Fitbit, Peloton, and Equinox across software, ML, and hardware. Stream has been featured in WSJ, Bloomberg, and Wired, with shipping planned for Summer 2026.
You will own the backend security systems that make Stream's privacy guarantees real. Rather than working in a separate security function, you'll be embedded in a small backend team building and operating a live production service. Your scope includes designing and shipping end-to-end encryption for user data with key management; building confidential-computing infrastructure for isolated and verifiable sensitive processing; owning identity and secrets management across the stack (workload credentials, service identities, environment isolation, privileged access); managing supply chain and CI/CD security; building detection and response loops with audit logging, alerting, and runbooks; driving vendor and data-handling security including AI provider agreements and OAuth scope review; leading compliance work (e.g., SOC 2) with systems-enforced controls and automated evidence; carrying a share of core backend work by building product features and reviewing changes with a security lens; and setting direction on secure engineering practice through design reviews and threat modeling.
This is a hands-on role where you'll define security culture at an early-stage company. You'll work on real-time Python services, make explicit tradeoffs between security controls and shipping velocity, and communicate with engineers, founders, auditors, and vendors.
REQUIREMENTS:
- 7+ years building and operating backend systems, with meaningful time as the engineer accountable for security on a production service
- Strong Python and comfort owning a live, real-time service end to end
- Hands-on applied cryptography: envelope encryption, authenticated encryption, key hierarchies, and practical mistake patterns
- Deep cloud security experience on AWS and/or GCP: IAM, workload identity federation, KMS, secrets management, audit logging
- Experience leading incident response on a production service, from containment through follow-up hardening
- Comfortable with document stores and their access-control models
- Ability to make tradeoffs explicitly and ship; understanding the difference between launch-gating controls and follow-up controls
- Precise communication with engineers, founders, auditors, and vendors
STRONGLY PREFERRED:
- Experience with confidential computing or attestation (Nitro Enclaves, SEV-SNP, TDX, App Attest)
NICE TO HAVE:
- iOS security primitives (Secure Enclave, Keychain)
- Bluetooth LE device security, firmware signing, or secure pairing
- Experience with retrieval systems or LLM infrastructure and their data-flow controls
- SOC 2 or ISO 27001 audit experience from the engineering side
