The Role

You will own Drivetrain's security posture across our product, cloud infrastructure and internal systems. Working closely with Engineering, DevOps and Compliance, you will make sure security is built into how we ship, not added after the fact. This is a hands-on role for someone who likes building systems, automating controls and using AI to scale a small security function well beyond its size. High-stakes work: you will protect the data that finance leaders at enterprise companies rely on.

What You'll Do

• Secure our cloud infrastructure (AWS), including IAM, network security, secrets management, logging and monitoring.
• Embed security into the SDLC through threat modeling, secure code reviews, and SAST, DAST and dependency scanning in CI/CD.
• Lead vulnerability management end to end, from discovery and triage to remediation with engineering teams.
• Own detection and incident response: build alerting, write runbooks, and lead investigations when something goes wrong.
• Drive compliance programs such as SOC 2 Type II, ISO 27001 and GDPR, and automate evidence collection wherever possible.
• Answer customer security questionnaires and join security reviews with enterprise prospects alongside the sales team.
• Manage third-party and vendor risk, including reviews of the AI and data vendors we integrate with.
• Assess and secure the use of LLMs in our product, covering prompt injection, data leakage and model access controls.
• Run security awareness for the team and make secure practices the easy default.

What You Bring

• 4 to 7 years of hands-on experience in security engineering, cloud security or application security, ideally at a B2B SaaS company.
• Strong working knowledge of AWS security services and Infrastructure as Code (Terraform or similar).
• Experience securing web applications and APIs, with a solid grasp of the OWASP Top 10.
• Comfort writing code or scripts (Python, Go or similar) to automate security tasks.
• Experience supporting SOC 2 or ISO 27001 audits.
• AI fluency is a must, not a nice-to-have. You use AI tools every day to speed up your work, whether that is triaging alerts, reviewing code, drafting policies or automating compliance evidence, and you can show us how.
• Clear communication, so you can explain risk to engineers, leadership and enterprise customers alike.

Nice to Have

• Experience securing LLM-powered features or AI agent workflows.
• Exposure to fintech or other products that handle sensitive financial data.
• Hands-on experience with tools such as Vanta, Drata, Wiz, Snyk or similar.
• Certifications such as OSCP, AWS Security Specialty, CISSP or CCSP.
• Experience as the first or founding security hire at a startup.