Software Engineer, Security

ABOUT US At Sierra, we’re creating a platform to help businesses build better, more human customer experiences with AI. We are primarily an in-person company based in San Francisco, with growing offices in Atlanta, New York, London, Paris, Madrid, Munich, Singapore, Japan, and Sydney. We are guided by a set of values that are at the core of our actions and define our culture: Trust, Customer Obsession, Craftsmanship, Intensity, and Family. These values are the foundation of our work, and we are committed to upholding them in everything we do. Our co-founders are Bret Taylor https://www.linkedin.com/in/brettaylor/ and Clay Bavor https://www.linkedin.com/in/claybavor/. Bret currently serves as Board Chair of OpenAI. Previously, he was co-CEO of Salesforce (which had acquired the company he founded, Quip) and CTO of Facebook. Bret was also one of Google's earliest product managers and co-creator of Google Maps. Before founding Sierra, Clay spent 18 years at Google, where he most recently led Google Labs. Earlier, he started and led Google’s AR/VR effort, Project Starline, and Google Lens. Before that, Clay led the product and design teams for Google Workspace. WHAT YOU'LL DO - Build the Foundations of Trust. Design and ship systems that make Sierra’s platform secure by default — spanning privacy, identity, authentication, authorization, and data security. You’ll work across backend services, APIs, and infrastructure layers to embed security-conscious design into the core of our product. - Own Cross-Cutting Systems. Partner with product and platform teams to implement and evolve Sierra’s trust primitives: identity management, access control, auditability, and data lifecycle management. You’ll make pragmatic design trade-offs between usability, performance, and security. - Secure Agentic AI Systems. Build controls that ensure AI agents can't leak customer data, execute unauthorized actions, or be manipulated into unintended behavior. Design runtime policy enforcement for tool use, implement safe agent sandboxing, and create boundaries that protect data while keeping agents powerful and useful. - Automate and Scale Security-Adjacent Workflows. Create developer-friendly tooling to reduce risk and friction — whether through automating security checks in CI/CD, enforcing privacy boundaries through schema validation, or instrumenting runtime monitoring for sensitive events. WHAT YOU'LL BRING - Strong Software Engineering Skills. Experience building and maintaining production systems in Python, Go, or TypeScript. You’re comfortable designing APIs, integrating with authentication or identity frameworks, and shipping high-quality code in a fast-paced environment. - Security Mindset. You may not be a dedicated security engineer, but you think like one — considering how data flows, where it’s stored, who can access it, and how to design for least privilege and transparency. - Product and Platform Mindset. You care about building secure systems that enable, not block, innovation. You work closely with product teams to make trade-offs clear and help them move quickly without sacrificing trust. - Curiosity and Ownership. You’re the kind of engineer who goes deep — tracing how a token propagates through the stack, or how an LLM might interact with internal APIs — because you want to understand and strengthen the system. EVEN BETTER IF… - You’ve worked on privacy, identity, trust & safety, auth/authz, or data protection systems. - You’ve built security frameworks, libraries, or tooling that developers actually use or integrated security automation into CI/CD pipelines. - You have exposure to AI systems or care about designing secure-by-default LLM applications. - You think like an attacker — you naturally ask "what could go wrong?" when reviewing designs or while building systems. You've found or fixed real security issues in production systems. - You thrive in 0→1 environments, where foundational systems have to balance speed, reliability, and t