Staff Security Engineer

Character.AI • Redwood City, CA

10h

About The Position

As a founding member of our security team, you will lead broad-scope initiatives to protect some of the most valuable intellectual property in the world—including our large language models, user data, and reputation. You will be responsible for both hardening our core infrastructure (Kubernetes, cloud compute, and LLM pipelines) and maturing our product development workflows and application architectures. You will ensure our systems and user-facing applications remain secure against sophisticated adversaries in a fast-paced environment.

Requirements

• Experience: 3–5+ years of experience in infrastructure, application, or product security.
• Cloud & Orchestration: Hands-on experience with Kubernetes, Docker, and cloud environments such as GCP or AWS.
• Technical Proficiency: Proficiency in Linux-based server environments and a high degree of comfort with the Linux CLI.
• Security Domain Knowledge: A deep understanding of web application attack vectors, secure system design at scale, and various SSH key management approaches.
• Engineering Skills: The ability to understand and contribute code to complex codebases and familiarity with common CI/CD-based workflows.
• Mindset: A demonstrated ability to work autonomously to identify and resolve problems independently with a proactive "get things done" mindset.

Nice To Haves

• Specialized Knowledge: Familiarity with service mesh technologies (Istio, Linkerd), Helm for Kubernetes management, or mobile application vulnerabilities.
• Program Management: Experience managing bug bounty programs or first-hand experience with product feature development.
• Language Familiarity: Experience with React, TypeScript, Python, Go, or other key technologies in our stack.
• Startup Background: Previous experience in a fast-growing technology startup.

Responsibilities

• Infrastructure Hardening: Envision, design, and implement hardened infrastructure, ensuring Kubernetes clusters and cloud compute environments (GCP/AWS) are configured to prevent unauthorized access.
• Application & Product Security: Holistically harden web and mobile applications (iOS/Android) and the web services that support them.
• Secure Development Lifecycle: Articulate and advocate for a comprehensive secure software development lifecycle (SDLC) and integrate security tooling into CI/CD pipelines to automate secure deployments.
• Architectural Design: Hook into product design processes to ensure new features and systems are designed with security and zero-trust concepts in mind from the start.
• Vulnerability Mitigation: Implement framework-level mitigations for recurrent application vulnerabilities and coordinate security assessments, including penetration tests and bug bounty programs.
• Developer Enablement: Design workflows and develop tooling that enables developers to securely utilize infrastructure and build artifacts while maintaining high velocity.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed