Senior Security Operations Engineer

Avante is hiring its first dedicated Security Operations Engineer. This is a senior, hands-on role accountable for the security of our production platform: identifying vulnerabilities across our code, cloud infrastructure, and dependencies, remediating them directly, and ensuring we detect and respond to threats within the timelines we have committed to our customers.

You will work directly in application code, cloud infrastructure, and our delivery pipeline, and you will ship fixes yourself rather than hand them off. Beyond remediation, you will own our cloud security platform, lead the design of our detection and on-call paging processes, and drive the selection and rollout of our security tooling.. As AI agents take on more of our implementation work, you will define the permissions, monitoring, and controls that allow them to operate safely at speed.

You will sit within Engineering and partner closely with our platform engineers, our Head of Trust and Compliance, and our IT Lead. Trust and Compliance owns the compliance program; this role owns security execution and the technical architecture behind it.

We evaluate candidates on demonstrated ownership of production security rather than years of experience. Within your first year, success means high-priority findings move through a repeatable process to verified fixes, zero-day vulnerabilities are patched quickly, alerts reach the right responder with clear context, and recurring remediation requires substantially less manual effort.

• Take findings through to verified fixes. Triage vulnerabilities and cloud configuration issues by exposure and impact. Reproduce the problem, patch code and dependencies, change infrastructure, and verify the fix in production.  Avante has recently implemented Wiz which will accelerate this process. Every significant finding gets an owner and a clear path to closure.
• Own detection and paging. Lead the process and tooling that decides what we detect, who gets paged, and what happens next. Partner with engineering leadership so zero-day vulnerabilities are patched as soon as they're disclosed and within our contractual response times. Write runbooks people can use, and help investigate and contain incidents.
• Run our cloud security platform. Keep the tooling that finds vulnerabilities and misconfigurations across our environment healthy, and make sure its findings turn into fixes instead of backlog.
• Secure the path to production. Improve scanning for code, dependencies, containers, secrets, and infrastructure changes. Automate triage and remediation where it helps, and test that our checks catch real problems without avoidable noise.
• Test how our systems can be misused. Run scoped API and application security testing, validate penetration-test findings, and lead red-team exercises, whether through a vendor, AI agents, or your own testing. Work with engineers on authentication, authorization, tenant isolation, and sensitive-data handling.
• Make agent access safer. Define and implement identities, permissions, approval boundaries, and audit trails for our agents. Work out how untrusted inputs and tool access could lead to unintended actions or data exposure, and close those paths.
• Use AI in your own security work. Use AI tools and agents to triage, investigate, and write fixes faster, with clear checks on what they produce and tight limits on what they can access.
• Keep security progress visible. Maintain a prioritized engineering backlog with Trust and platform partners, explain remaining risk in plain terms, and evaluate new tools against specific gaps and operating costs.

• Substantial hands-on experience in security engineering, cloud security, application security, or a closely related engineering role, with the judgment to own this work independently
• A record of fixing production security issues yourself: reading application code, investigating an API, changing infrastructure configuration, and carrying a remediation through testing and release
• Practical experience with cloud identity and access controls, containers, infrastructure as code, vulnerability management, and security logging. Depth in Azure, GCP, or a comparable cloud transfers well.
• Experience investigating security events and turning what you learned into better detection, response, and prevention
• Sound judgment on patches and upgrades that break things: you can size the impact of a version bump and handle the code changes it forces
• Active use of AI tools or agents in technical work, with concrete examples of how you validate their output and limit their access. Independent projects count.
• Clear prioritization and communication. You can explain why a risk matters, choose a proportionate response, and work well without a large security team behind you.

Nice to Have

• Experience with TypeScript, PostgreSQL, and Terraform or Terragrunt
• Hands-on time with Wiz, Microsoft Defender, or Datadog
• Experience selecting and implementing a SIEM
• Security work on LLM applications and agents
• Engineering controls in environments that handle health or other sensitive data

Interview Process:

• Initial screen with our recruiters
• Video Interview with our Engineering Manager
• Technical interview focused on real-world problem solving (no whiteboard algorithms)
• On-site interview loop:
• Team behavioral interview (60 min)
• Session with our Engineering Manager (60 min)
• Final conversation with our CTO (30 min)

The base salary for this role is $170,000–$210,000. Where you land in that range depends on your experience, your skills, and how well your background fits what the role needs.

We also offer:

• Equity: Stock options, so you share in what we’re building
• Health coverage: Medical, dental, and vision, with employee premiums covered by Avante
• Unlimited PTO: Take the time you need to rest and recharge, plus paid company holidays
• Retirement: 401(k)
• Commuter benefit: $150/month toward however you prefer to get to work

Avante is an Equal Opportunity Employer. We’re building a diverse, inclusive team and welcome candidates of all backgrounds.