Staff Security Engineer

About Refold AI
Refold AI is the AI integration platform built for agents, made for modern SaaS companies that need to ship enterprise integrations at scale. We're reimagining integrations with AI agents that work like business consultants and integration engineers, building them 10x faster, in hours instead of days. The payoff: integrations stop being a bottleneck that costs you deals and burns margin, and become a growth engine. You win the enterprise deals that hinge on them, onboard faster, and scale without an army of consultants.
We've grown rapidly, reaching seven-figure ARR and 30+ paying customers, powering the product and professional services teams at modern SaaS companies, from Incorta, Kantata, and Coupa to Highradius, Naehas, and OvationCXM.
Refold AI has raised $6.5M from world-class investors including Eniac Ventures (early investors in Airbnb & Uber), Tidal Ventures, and Better Capital.
About this role:
You will set the security direction for the whole platform and build much of it with your own hands. This is a hands-on Staff+ role: you write code, review designs, and lead incidents, not only policy.
Your mandate covers four things:
Protect customer credentials and data across a multi-tenant platform and every deployment model we ship.
Make AI agents safe to connect to enterprise systems, from prompt injection to tool-permission scope.
Harden how we build and ship, from the monorepo and CI to the images and Helm charts customers run in their own clusters.
Turn security into a sales advantage by owning the technical side of enterprise security reviews and our compliance program.
You will work across every engineering team, partner with product and go-to-market, and help hire and grow the security function.
What you'll do:
Cloud and infrastructure security
Harden our GCP and GKE footprint: IAM, workload identity, network policy, egress control and private control planes.
Own secrets and key management end to end, including rotation, short-lived credentials and KMS-backed encryption.
Build runtime security for containers and nodes, so a compromised workload is detected and contained fast.
Product and application security
Threat-model the integration engine, credential vault, workflow runtime and webhook surface, and drive the fixes.
Guarantee tenant isolation across shared data stores, queues and workflow engines.
Design safe execution for customer-authored code and custom actions.
Raise the bar on authentication and access: SSO, SCIM, RBAC, API keys and OAuth flows.
AI and agent security
Define how AI agents get scoped, auditable access to enterprise systems through our MCP servers and AI gateway.
Defend against prompt injection, tool misuse and data exfiltration through agents.
Software supply chain
Secure the monorepo, CI pipelines and release process: branch protection, signed and provenance-attested images, SBOMs and dependency scanning.
Make the images and Helm charts that customers install in their own clusters trustworthy and easy to verify.
Detection and incident response
Build logging, detection and alerting that catch real attacks, with low noise.
Lead security incidents end to end: triage, forensics, containment, customer communication and the post-incident fix.
Customer trust and compliance
Be the senior technical voice in enterprise security reviews, questionnaires and customer calls.
Run SOC 2 and ISO 27001 as engineering work: automate evidence, own pen-test scoping and drive remediation.
Publish hardening guidance for customers who self-host or run Refold in their own cloud.
Leadership
Build paved roads so the secure way is the easy way for every engineer.
Mentor engineers, run a security-champions program, and help hire the security team.
What we're looking for:
Typically 8+ years in security or software engineering, including several years as the senior security engineer for a multi-tenant SaaS platform.
Deep cloud and Kubernetes security experience. GCP and GKE preferred; strong AWS or Azure depth is fine.
Strong application security: threat modelling, secure design review, and code review in at least one of TypeScript/Node.js, Python or Go.
Fluency with OAuth 2.0, OIDC and SAML, secrets management, key management and encryption design.
You have led real production security incidents, including forensics and customer communication.
Hands-on software supply chain work: CI/CD hardening, artefact signing, SBOMs and dependency risk.
You write production-quality code and ship tooling, not only recommendations.
You have represented a company's security in front of enterprise security teams, and won their trust.
You can turn SOC 2 or ISO 27001 controls into engineering systems instead of spreadsheets.
Clear, direct writing. You explain risk to engineers, executives and customers in their own terms.
Bonus points:
Security work on LLM and agent systems: OWASP Top 10 for LLM applications, MCP, tool-use permissions.
Sandboxing and isolation for untrusted code, such as gVisor, Firecracker or V8 isolates.
Shipping software that customers run in their own environments: BYOC, on-prem, air-gapped.
Securing workflow engines and data stores such as Temporal, MongoDB, Redis and PostgreSQL.
Background in integration platforms, iPaaS, or enterprise systems like SAP, Workday or Salesforce.
Offensive security experience, published research, CVEs or open-source security tooling.
HIPAA or other regulated-data experience.
You have built a security team from the first hire.

Work arrangement
Hybrid