Senior Security Engineer
Job Description
About Aleroy
Aleroy is building a unified platform for high-performance AI inference, making it easier for companies to deploy and run AI models at scale.
Through a single API, Aleroy provides access to ready-to-use and custom AI models across cloud infrastructure, dedicated capacity, and customers' own hardware. Our platform optimizes performance, cost, and deployment flexibility while giving enterprises control over where and how their AI workloads run.
We work in small teams, collaborate directly, and focus on solving complex engineering challenges to build reliable, scalable AI infrastructure.
About the Role
You are our first dedicated security engineer. Our engineering team builds and runs a multi-tenant cloud platform that also runs on infrastructure from partners. You review it, test it and challenge it, so that we, our customers and our auditors can trust it. The role is independent of the teams whose work you review, which is why it reports to the COO. You work closely with our CTO and engineers every day. We are preparing for ISO 27001 and SOC2, and you will help keep the technical side of that work honest after certification.
What You Will Own
Threat modelling and design review. Security review of new features and architecture changes before they ship.
Security testing. Regular testing of our applications, APIs and cloud setup, and follow-up until findings are fixed.
Tenant isolation. Review of how customer data and workloads are kept apart, and proof that it holds.
Cloud and production access. Review of access, secrets and configuration across our cloud and production systems.
Partners and suppliers. Technical security due diligence on partners and suppliers whose infrastructure we use.
Data handling. Checking that data retention and deletion work as designed, with evidence.
Customer and audit assurance. Technical evidence for customer security reviews and for our ISO 27001 and SOC 2 audits.
Examples of Work in Your First Months
A threat model of our core platform, agreed with engineering.
A first round of security testing, with a clear plan for the findings.
A simple, repeatable process for reviewing new partners before they go live.
About You
6 to 10 years in security, with most of it in application security or cloud security.
Hands-on testing skills: code review, API and web application testing, cloud configuration review.
Deep experience with at least one major cloud provider, and with containers and Kubernetes or similar.
You have secured a multi-tenant SaaS or platform product.
You have implemented security controls that went through an ISO 27001 or SOC 2 audit, and you can show the evidence they produced.
You have worked in a startup or scale-up, ideally as the first or an early security hire.
You say clearly when something is not safe, explain the risk in business terms, and bring a practical fix.
You work well with engineers: you review and challenge their work and still keep their trust.
Clear written English. Your findings and reports can go straight to a customer or an auditor.
Nice to Have
Security of AI and LLM systems.
Experience with key management, wallets or other crypto infrastructure.
Scripting and automation, including using AI tools in security work.
Experience working with customers in regulated or government sectors.
What We Offer
The chance to build the security function of a growing group from the start.
Direct work with the COO and CTO, and quick decisions.
A competitive package, discussed during the process.
24 days annual leave plus public holidays.
Health insurance.
Modern office in Yas Creative Hub.
