Security platform engineer

We’re looking for a platform engineer to build the secure-delivery capabilities other engineers use every day. You’ll turn security requirements into reliable integrations, useful feedback, and self-service workflows that work across our production repositories.

• Deploy, configure, integrate, and tune static analysis, dependency, secret, container, and Infrastructure as Code scanning in our CI/CD workflows.
• Inventory production repositories and delivery paths, including prompts and model configuration.
• Make scanner coverage distinct from application-specific tests of AI behavior; AppSec defines those tests, and you operate agreed delivery checks.
• Start new checks in report-only mode where appropriate, then implement agreed warn and block policies using exploitability, exposure, and compensating controls.
• Give engineers self-service exceptions within documented rules, with an owner, justification, expiry, and audit trail.
• Escalate decisions outside those rules to Security leadership with the relevant specialist analysis.
• Build automation and AI-assisted workflows that enrich findings, propose fixes, and support Product Engineering’s triage under documented criteria.
• Preserve required checks, review, and rollback for automated patch changes.
• Make coverage, integration failures, finding age by risk, time to triage and remediate, false blocks, build delay, and bypasses visible.
• Record mitigations separately from completed fixes and connect useful telemetry to GRC evidence.
• Work with Infrastructure on cloud-posture monitoring, useful critical-misconfiguration alerts, and bounded remediation automation.
• Extend into shared-image hardening and artifact provenance as the delivery foundations mature.
• Map production delivery paths and gaps across code, infrastructure, prompts, configuration, and evals, with clear ownership of the different checks.
• Deliver a bounded scanning integration, such as secret push protection or report-only static analysis, with a usable finding workflow.
• Establish initial warn, block, and self-service exception rules with the relevant partners and make Product Engineering ownership visible.
• Baseline coverage, integration failures, false blocks, and build delay so the next rollout has evidence to build on.

• You’ve built and operated CI/CD, developer tooling, or infrastructure automation used by other engineers.
• You can write maintainable code, explain the failure modes of what you shipped, and use security evidence to make a practical rollout decision.
• You’ve applied AI in engineering and can explain how you check its outputs and permissions.
• For this role, CI/CD and infrastructure automation experience matter more than familiarity with a particular scanner.
• GitHub Actions or comparable systems, Terraform, containers, and cloud controls are relevant.
• You should be comfortable writing production automation in TypeScript, Python, Go, or a comparable language.
• Будет плюсом: Supply-chain and scanner experience is useful; you can learn individual tools as part of the work

• What Ashby gives you in return is the best of both early and growth-stage environments. The agency and no-nonsense of a seed startup: you contribute to useful projects, make practical decisions, and work in an almost-no-meeting culture. The product-market fit and scale of a growth-stage startup: tens of thousands of daily users who depend on our software, and customers whose trust your work will help us earn.
• Competitive salary and equity.
• 10-year exercise window for stock options. You shouldn’t feel pressure to purchase stock options if you leave Ashby —do it when you feel financially comfortable.
• Unlimited PTO, and we will encourage you to take it.
• A minimum of 12 weeks of fully paid parental leave, covered by Ashby. The actual number may increase to satisfy local requirements.
• Generous equipment, software, and office furniture budget. Get what you need to be happy and productive!
• $100/month education budget with more expensive items (like conferences) covered with manager approval.
• If you’re in the US, we offer top-tier health insurance for you and your dependents, with 100% of premiums covered by Ashby. In other countries, we provide high-quality supplemental health insurance for you and your dependents, also fully covered by us.