Security Engineer
Town.com · New York, NY · San Francisco, CA
Own security end to end for Town's AI assistant and the agent that acts on users' email, calendar, docs, Slack and CRM data. Work spans application and product security, cloud infrastructure, data pipeline protection, and building secure development and incident response practices.
What you'll do
- Own application and product security for the Town assistant and agent action surface
- Threat-model autonomous agent behavior such as prompt injection and tool misuse
- Secure the data pipeline with encryption, tenant isolation, access controls and secrets management
- Harden cloud infrastructure and third-party OAuth integrations
- Build secure SDLC and run incident response
Requirements
- Extensive experience in security engineering with depth in application and/or infrastructure security
- Can read and write production code
- Has secured a multi-tenant SaaS product handling sensitive user data at scale
- Knowledge of cloud security (AWS and/or GCP), authn/authz, secrets, and encryption
- Threat-modeling skills and ability to explain risk to engineers and founders
- Willing to work in person in San Francisco five days a week
Skills
Outlined skills are listed as required.
Full original description
About Town
Town is building the AI coworker for every team. Everyone gets their own Townie, an AI assistant that learns how you work (your voice, judgment, relationships, and priorities) and does real work on your behalf across email, calendar, docs, Slack, and CRM. Townies don't wait to be prompted. They observe, learn, and act. And because every teammate has one, Townies can ask each other questions and hand off work, so the whole team moves faster together.
Four months after our public launch, we became a $1B company. We recently raised a $108M Series B, co-led by Forerunner Ventures and Menlo Ventures, with continued support from Andreessen Horowitz, First Round Capital and angels such as Zach Perret, Soleio Cuervo, Scott Belsky, and more. Our founders, Jean-Denis and Tony, previously led EPD at Plaid and applied AI product at Google.
About the role
Town holds the keys to a person's entire working life. To do real work on someone's behalf, it reads their email, moves through their calendar, acts in their docs, Slack, and CRM. This means that security is absolutely paramount. We're looking for a dedicated Security Engineer to own that surface end to end.
You'll set the security bar for a company whose whole premise is trusted, autonomous access to sensitive data. That means securing the product and the agent that acts inside it, hardening the infrastructure and data pipeline behind it, and building the practices - threat modeling, secure SDLC, incident response. etc. that let us move fast without betraying that trust.
What you'll do
Own application and product security across the Town assistant and the agent action surface — the systems that read and act on user data across email, calendar, docs, Slack, and CRM.
Threat-model autonomous agent behavior: prompt injection, tool misuse, the "lethal trifecta" of untrusted input + sensitive data + external action, and the guardrails that contain it.
Secure the data pipeline behind Town's persistent model of each user — encryption, tenant isolation, access controls, and secrets management.
Harden our cloud infrastructure and third-party OAuth integrations (Google, Slack, CRM) against real-world attack.
Build the secure development lifecycle: design reviews, code review for security, dependency and supply-chain hygiene, and the tooling to scale it.
Stand up and run incident response — detection, triage, and clean postmortems.
Partner across engineering to make the secure path the easy path.
You might thrive here if you...
Have extensive experience in security engineering, with real depth in application and/or infrastructure security.
Can read and write production code — you fix problems, not just file them.
Have secured a multi-tenant SaaS product handling sensitive user data at scale.
Know your way around cloud security (AWS and/or GCP), authn/authz, secrets, and encryption in practice.
Threat-model instinctively and can explain risk to engineers and founders without hand-waving.
Want to be the person who owns security from the ground up, and move at startup speed doing it.
Get energy from working in person - we're 5x per week at our office in downtown SF
Location
In-person in San Francisco's Financial District, five days a week. Everyone is here to do their best work and make this product a success.