Staff Security Engineer, Norm AI

• 4+ years of experience in product security, application security, offensive security, and/or security-focused software engineering
• Strong proficiency in developing secure cloud-native containerized applications in at least one programming language commonly used for backend development, although Python experience is preferred
• Demonstrated experience writing high-quality software and raising the quality bar of software engineering teams
• Proven ability to identify software vulnerabilities, demonstrated through CVEs, bug bounty awards, blog posts, or prior work experience
• Track record of building reliable and scalable security systems and controls
• Proficiency with data storage technologies such as PostgreSQL and Redis from a security perspective
• Experience with observability and security monitoring tools such as Datadog or OpenTelemetry
• Proficiency with at least one of the major cloud providers, preferably both AWS and Azure
• Proficiency with Infrastructure as code tools, preferably Terraform
• Strong communication and collaboration skills, particularly with engineering teams

Desirable

• As a Security Engineer on the Platform team at Norm Ai, you will architect and build the security foundation for our AI-driven compliance platform
• You'll work at the intersection of product security, infrastructure protection, and AI safety, building foundational security services that enable both our platform reliability and our engineering teams' velocity
• You will define, build, and own the authentication and authorization posture that protects our entire ecosystem: our core multi-tenant platform and our growing number of isolated, single-tenant customer deployments
• You'll have significant input into our security architecture and the freedom to propose and implement security improvements across our entire technology stack
• Our customers depend on us to deliver a secure, trustworthy, and compliant platform for managing regulatory requirements
• DeYou'll deauthentication systems, access control frameworks, and data protection mechanisms for our AI-driven compliance platform
• Build secure-by-default libraries and tools that make the secure path the easiest and most attractive choice for developers
• Review security-critical code and own key security components, including authentication, access control, and data protection systems
• Contribute meaningfully to the Norm AI codebase, focusing on security enhancements for our DSL execution engine and compliance workflows
• Create comprehensive security monitoring and alerting systems to provide visibility into the health and security posture of our infrastructure
• Audit the existing codebase for vulnerabilities, particularly in our LLM client and customer data handling
• Improve our static analysis and vulnerability management tooling
• Conduct red team exercises and penetration testing to identify security gaps
• Participate in and drive mitigation strategies during security-related incident responses
• Partner closely with engineering teams to incorporate secure design principles at every stage of development
• Mentor other engineers on security best practices and secure development methodologies
• What Success Looks Like - 30 Days
• Norm AI platform onboarding: Rapidly familiarize yourself with Norm AI's existing infrastructure, architecture, and the unique security challenges of our AI-driven compliance solutions
• Security assessment: Identify key areas for security improvement in existing foundational services and other aspects of Norm AI's architecture
• Monitoring & alerting: Implement essential security improvements to our monitoring and alerting systems to provide visibility into the security health and performance of our infrastructure
• What Success Looks Like - 60 Days
• Security enhancement: Based on security gaps you observe over the first few weeks, design and implement an enhancement to a core platform security service, such as improving authentication mechanisms for our compliance data access or strengthening our platform security
• Documentation & best practices: Contribute to internal documentation by creating or significantly improving security documentation for a key platform component in a way that helps both engineers and their AI coding tools better understand secure development practices
• Also contribute to external documentation that can be shared with Norm’s clients
• What Success Looks Like - 90 Days
• Platform security scalability: Dive deep into the security aspects of our platform code and propose security enhancements that improve its resilience and scalability while maintaining compliance with regulatory requirements
• Knowledge sharing: Begin mentoring other engineers on security best practices by leveraging your experience to improve their security awareness, enhance their understanding of secure coding practices, and foster better security-conscious development across the team