Senior Security Platform Engineer - Secure Delivery

Hi 👋🏻 I’m Louis, Head of Security. You’ll report directly to me.

What Ashby gives you in return is the best of both early and growth-stage environments. The agency and no-nonsense of a seed startup: you contribute to useful projects, make practical decisions, and work in an almost-no-meeting culture. The product-market fit and scale of a growth-stage startup: tens of thousands of daily users who depend on our software, and customers whose trust your work will help us earn.

We have notable customers like Notion, Linear, Shopify, and Snowflake. Our growth and retention metrics are best-in-class among our peers: we have tens of millions in ARR, growing >100% year over year, very low churn, and many years of runway.

You’ll join our Security team, a single team with multiple specializations overseeing security across the business. I report to Abhik, our Co-Founder and VP of Engineering. We read every application and aim to respond to yours within 3-4 days (often sooner).

Role Overview

We’re looking for a platform engineer to build the secure-delivery capabilities other engineers use every day. You’ll turn security requirements into reliable integrations, useful feedback, and self-service workflows that work across our production repositories.

You’ll treat engineers as your users and own the operation of what you ship. You’ll use existing tools where they fit and build the capabilities that materially improve our delivery workflow.

About the Role and How We Work

We’re also advertising this opening as Senior DevSecOps Engineer. Both titles describe the same position; please apply once using the title that best reflects your experience.

Your mission is to make our delivery pipeline secure by default across application code, infrastructure, dependencies, containers, and product configuration. You’ll own the technical implementation and operation of delivery-security tooling and controls, including integration, configuration, tuning, reliability, and coverage.

Product Engineering teams own triage and remediation for the features they maintain. Application Security provides specialist analysis and defines product-security test requirements. Infrastructure retains ownership of the underlying cloud platform. You’ll work with those teams to make agreed checks and policies run reliably in the delivery workflow.

Responsibilities

• Deploy, configure, integrate, and tune static analysis, dependency, secret, container, and Infrastructure as Code scanning in CI/CD workflows.
• Inventory production repositories and delivery paths, including prompts and model configuration. Make scanner coverage distinct from application-specific tests of AI behavior.
• Start new checks in report-only mode where appropriate, then implement agreed warn and block policies using exploitability, exposure, and compensating controls.
• Give engineers self-service exceptions within documented rules, with an owner, justification, expiry, and audit trail. Escalate decisions outside those rules to Security leadership.
• Build automation and AI-assisted workflows that enrich findings, propose fixes, and support Product Engineering’s triage under documented criteria.
• Make coverage, integration failures, finding age by risk, time to triage and remediate, false blocks, build delay, and bypasses visible.
• Work with Infrastructure on cloud-posture monitoring, useful critical-misconfiguration alerts, and bounded remediation automation.
• Extend into shared-image hardening and artifact provenance as delivery foundations mature.

Example Projects You Might Work On

• Roll out secret scanning with push protection and make a blocked push understandable and actionable for an engineer.
• Turn a repeated scanner-exception request into a PR workflow with a reason, expiry, and evidence for revisiting it.
• Reproduce a dependency issue in the application, add a regression check, and build a workflow that proposes a patch with useful evidence.
• Show which delivery paths are covered, where checks fail, and whether enforcement is addressing risk while keeping build delays reasonable.

Qualifications & Requirements

• You’ve built and operated CI/CD, developer tooling, or infrastructure automation used by other engineers.
• You can write maintainable code, explain the failure modes of what you shipped, and use security evidence to make practical rollout decisions.
• Experience applying AI in engineering, with an understanding of how to verify outputs and permissions.
• Proficiency in writing production automation in TypeScript, Python, Go, or a comparable language.
• Experience with GitHub Actions (or comparable systems), Terraform, containers, and cloud controls.

You Might Not Enjoy This Role If:

• You prefer to deliver a prototype and hand off its operation. Reliability, tuning, and existing integrations are part of the core work.
• You prefer a prescribed backlog over investigating ambiguous problems, writing proposals, and bringing partners into the work.
• You want standalone assessments to be your main output instead of working delivery capabilities.

Interview Process

1. Recruiter Screen (30 mins)
2. Hiring Manager Intro Call (20 mins)
3. Past Projects Deep Dive (45 mins)
4. Founder Screening (45 mins)
5. Take-Home Assessment + Practical Review (1 hr review; 2-3 hrs spent on take-home)
6. Cross-Functional Stakeholder Interview (45 mins)

Benefits

• Competitive salary and equity with a 10-year exercise window for stock options.
• Unlimited PTO (and encouragement to take it).
• Minimum 12 weeks of fully paid parental leave.
• Generous equipment, software, and office furniture budget.
• $100/month education budget (plus approval for larger items like conferences).
• Top-tier or high-quality supplemental health insurance for you and your dependents (100% covered by Ashby).