Staff Security Engineer, Character.ai

• Experience: 3–5+ years of experience in infrastructure, application, or product security
• Cloud & Orchestration: Hands-on experience with Kubernetes, Docker, and cloud environments such as GCP or AWS
• Technical Proficiency: Proficiency in Linux-based server environments and a high degree of comfort with the Linux CLI
• Security Domain Knowledge: A deep understanding of web application attack vectors, secure system design at scale, and various SSH key management approaches
• Engineering Skills: The ability to understand and contribute code to complex codebases and familiarity with common CI/CD-based workflows
• Mindset: A demonstrated ability to work autonomously to identify and resolve problems independently with a proactive "get things done" mindset

Desirable

• As a founding member of our security team, you will lead broad-scope initiatives to protect some of the most valuable intellectual property in the world—including our large language models, user data, and reputation
• You will be responsible for both hardening our core infrastructure (Kubernetes, cloud compute, and LLM pipelines) and maturing our product development workflows and application architectures
• You will ensure our systems and user-facing applications remain secure against sophisticated adversaries in a fast-paced environment
• Infrastructure Hardening: Envision, design, and implement hardened infrastructure, ensuring Kubernetes clusters and cloud compute environments (GCP/AWS) are configured to prevent unauthorized access
• Application & Product Security: Holistically harden web and mobile applications (iOS/Android) and the web services that support them
• Secure Development Lifecycle: Articulate and advocate for a comprehensive secure software development lifecycle (SDLC) and integrate security tooling into CI/CD pipelines to automate secure deployments
• Architectural Design: Hook into product design processes to ensure new features and systems are designed with security and zero-trust concepts in mind from the start
• Vulnerability Mitigation: Implement framework-level mitigations for recurrent application vulnerabilities and coordinate security assessments, including penetration tests and bug bounty programs
• Developer Enablement: Design workflows and develop tooling that enables developers to securely utilize infrastructure and build artifacts while maintaining high velocity