Software Engineer — Security
at Snorkel AI · 101-250 employees
Equity · Aug 2025
- Work model
- Hybrid
- Location
- New York City, NY (Hybrid); San Francisco, CA (Hybrid)
- Posted
- 5d ago
pythongorestawsgcpazurekubernetesterraformci/cd
at Snorkel AI · 101-250 employees
Snorkel AI provides a programmatic data-labeling and evaluation platform that converts unstructured data into expert-curated training and benchmark datasets via SDKs, no-code templates, and subject-matter expert workflows.
<div class="content-intro"><p><strong>About Snorkel</strong></p> <p>At Snorkel, we believe meaningful AI doesn’t start with the model, it starts with the data.</p> <p>We’re on a mission to help enterprises transform expert knowledge into specialized AI at scale. The AI landscape has gone through incredible changes since 2015, when Snorkel started as a research project in the Stanford AI Lab, to the generative AI breakthroughs of today. But one thing has remained constant: the data you use to build AI is the key to achieving differentiation, high performance, and production-ready systems. We work with some of the world’s largest organizations to empower scientists, engineers, financial experts, product creators, journalists, and more to build custom AI with their data faster than ever before. Excited to help us redefine how AI is built? Apply to be the newest Snorkeler!</p></div><p><strong>About the Role</strong></p> <p>We are seeking a Security Engineer to evolve Snorkel's security posture across our cloud infrastructure, developer platform, and product ecosystem. You will partner with the security lead to secure cloud environments, build security automation, guide cross-functional initiatives, and embed security into our engineering workflows.</p> <p>You will work across infrastructure, platform, product, and application teams to ensure our systems scale securely and meet the bar required for modern, cloud-native, compliance-focused environments. This is a high-impact role where your ability to work effectively with others matters as much as your technical depth.</p> <h1><strong>Key Responsibilities</strong></h1> <ul> <li>Build and scale <strong>Infrastructure as Code (IaC) governance strategies</strong> that embed security while enabling developer velocity</li> <li>Operate and tune <strong>Cloud Security Posture Management (CSPM) tooling</strong> and coordinate remediation through engineering teams</li> <li>Investigate <strong>security events</strong>, triage incidents, identify root causes, and own remediation through resolution</li> <li>Architect secure <strong>AWS cloud account structures</strong> — landing zones, multi-account patterns, network segmentation, and cross-account role strategies</li> <li>Design and implement <strong>network security architectures</strong> using security groups, Network Access Control Lists (NACLs), subnetting, routing layers, and egress controls</li> <li>Establish secure-by-default design patterns across <strong>Kubernetes</strong> and containerized workloads</li> <li>Design, maintain, and govern <strong>Identity and Access Management (IAM) role & policy architectures</strong> for both human and machine identities</li> <li>Implement <strong>encryption everywhere</strong> — data-at-rest, data-in-transit, and key rotation using AWS Key Management Service (KMS) and related services</li> <li>Conduct <strong>threat modeling</strong>, architecture reviews, and secure design assessments for new and existing systems</li> <li>Assess and secure <strong>AI/ML product architectures</strong>, including trust boundaries, API boundaries, and data flow through training and inference pipelines</li> <li>Build secure automation through Python, AWS-native services, and policy-as-code frameworks</li> <li>Own <strong>complex security projects end-to-end</strong> — from discovery and design docs to implementation, rollout, and long-term ownership</li> <li>Align cloud security strategy with relevant frameworks (NIST CSF, ISO 27001, SOC 2, CIS benchmarks)</li> </ul> <h1><strong>Professional Skills</strong></h1> <p>Security at a growing startup is not a solo effort. This role succeeds by making the entire organization more secure <em>through</em> the people and teams around you. These skills are not secondary to technical ability — they shape whether security work actually lands and delivers lasting impact.</p> <h2><strong>Communication & Influence</strong></h2> <ul> <li>Communicates security risks, trade-offs, and recommendations clearly to both technical and non-technical audiences</li> <li>Writes concise, structured technical documentation — design docs, runbooks, postmortems, and policy proposals that others can act on without follow-up clarification</li> <li>Builds alignment on security priorities across teams without relying on positional authority — a small security team cannot mandate adoption; it must earn buy-in</li> </ul> <h2><strong>Cross-Functional Partnership</strong></h2> <ul> <li>Builds trust with engineering, product, and infrastructure teams by proposing solutions that balance security posture with developer velocity — security controls that teams resist or work around deliver zero impact</li> <li>Defaults to collaboration over enforcement — works <em>with</em> teams to find the right path forward rather than handing down requirements</li> <li>Seeks to understand the workflows, constraints, and incentives of partner teams before proposing changes — the best security solution is one the team will actually implement and maintain</li> </ul> <h2><strong>Ownership & Judgment</strong></h2> <ul> <li>Comfortable with broad ownership, context-switching, and exercising judgment without a large support structure — this role requires self-direction, not delegation</li> <li>Exercises sound judgment on when to push hard on a security requirement versus when to accept managed risk with compensating controls</li> <li>Balances thoroughness with pragmatism — delivers iterative security improvements that compound over time rather than waiting for perfect solutions that never ship</li> <li>Manages multiple concurrent initiatives with clear ownership, status communication, and escalation when blocked</li> </ul> <h2><strong>Teaching & Growth</strong></h2> <ul> <li>Multiplies impact by making others better — equips engineers across the organization to build securely by default through training, code review feedback, and accessible documentation</li> <li>Frames securi