Security Lead

San FranciscocontractOn Site

Apply on Employer Site

senior

$198k–$221k

H1B: no

Runtrellis Security Lead at Runtrellis owning security end to end including cloud, application, endpoint, and data security. Responsible for setting security strategy, running offensive security, and managing vulnerabilities.

Responsibilities

We're hiring our first Security Lead to own security at Trellis end to end. Our agents read and write to electronic health records, fill out insurance portals, and handle protected health information for some of the largest healthcare providers in the country. Customers trust us with that data, and you'll make sure that trust is earned without slowing down how fast we ship.
This is a hands-on role. You'll set the security strategy, build the controls yourself, test them like an attacker would, and be the person customers talk to when they want to know how we keep their data safe. You'll report to Jacky (Co-founder & CTO).
Own security end to end: Set the roadmap across cloud, application, endpoint, and data security, and decide what matters most right now
Balance security with speed: Build guardrails and paved roads so engineers can ship quickly and safely, rather than adding gates that slow the team down
Run offensive security: Pen test our own agents, infrastructure, and Windows session fleet; run red-team exercises and fix what you find
Lock down the cloud and identity: Own AWS security posture, IAM, secrets management, least-privilege access, and trust boundaries between customers, agents, and internal systems
Manage vulnerabilities: Stand up scanning, triage, and patching across code, dependencies, containers, and hosts, with clear SLAs
Be the voice of security to customers: Answer security questionnaires, join diligence calls, and lead audits and certifications (SOC 2, HIPAA, HITRUST as needed)
Plan for incidents: Build logging, detection, and an incident response plan, and run the response when something happens

Qualification

WHAT YOU'LL BRING6+ years in security engineeringDeep experience with AWS securityHands-on offensive security experienceClear communication with engineersWHY WORK WITH US

Required

You've been the person responsible for security, not just a contributor to it. You're as comfortable reviewing an IAM policy or writing an exploit as you are walking a hospital CISO through our architecture. You care about real risk more than checklists, and you know that a security program engineers route around is not a security program.
WHAT YOU'LL BRING
6+ years in security engineering, with time owning security at a startup or high-growth company
Deep experience with AWS security, IAM, and cloud infrastructure
Hands-on offensive security experience: penetration testing, red teaming, or bug bounty work
Experience running vulnerability management and incident response programs
Experience leading SOC 2 and/or HIPAA compliance efforts and answering customer security reviews
Comfort with Windows Server and Active Directory environments is a plus
Healthcare or other regulated-industry experience is a big plus
Clear communication with engineers, executives, and customers
High ownership and the ability to operate autonomously in a fast-moving startup
WHY WORK WITH US

Company

Runtrellis

View company page

Source: ashby

Active within the past hour

More roles at Runtrellis

Sales Development Representative (SDR/BDR)

RCM Operations Specialist, Infusion (AI Platform)

San Francisco

Boost Your Interview Chances

Improve Resume Match Score

Free

Your Score

9.0

Strong Applicant

Must-Have Skills for This Role

AWSIAMcloud infrastructurepenetration testingred-team exercisesSOC 2

Optimize my Resume

Apply Faster with Autofill

Free

Save your profile once. LumiJobs pre-fills the employer's application form so you stop re-typing the same answers on every site.

Apply With Autofill

Or skip LumiJobs's tools and submit directly on the employer's career site.

Apply on Employer Site