Skip to content
New: Replays now compare against the last 90 days. Read the changelog

Security engineer

Keep agents inside their permissions, run our audits, and answer the questionnaires with our customers.

Our customers hand agents their Stripe keys, their support queues and their CRMs. The reason they can is that an agent in Capstan can only do what its owner allowed, and nothing it reads can change that. You'll be the second person on the security team, working with Astrid Berg, and you'll make sure that promise stays true as the product grows.

What you'll do

  • Review every change to permissions, the write gate and tool connections before it ships, and build the tests that make those reviews faster.
  • Own our defences against prompt injection: the checks that stop text in a ticket, an email or a web page from changing what an agent may do.
  • Run the SOC 2 Type II audit with our auditors each year, and plan the work for ISO 27001.
  • Manage our penetration tests and our disclosure inbox, and reply to researchers within two working days.
  • Join customer security reviews and fill in the questionnaires with them, in plain words.

What you'll bring

  • Four or more years in application or product security at a software company.
  • You can read TypeScript and find the bug, and write the fix yourself when it's small.
  • Experience with secrets management, OAuth and scoped API keys.
  • You explain risk in terms a support lead and a CFO both understand.

Nice to have

  • Hands-on work on LLM security: injection, tool misuse, data exfiltration through model output.
  • You've taken a company through its first SOC 2 or ISO audit.

Where you'll work

Remote, anywhere in the US or the EU, with two weeks a year together in Stockholm. The salary range above is for the US; the EU range is €95,000 to €120,000.

Sample role. Replace the files in content/careers with your own.

Apply for this role

Five fields, no account and no cover letter. Here's what happens after you send it:

  1. 1A conversation · 30 minutes
  2. 2A paid work sample · 3 hours, $300
  3. 3A day with the team · 4 conversations
  4. 4A decision · Within 5 working days

One link is enough. We read it before anything else.

City and country, so we can check the role works where you are.

A few lines in your own words. No cover letter needed.

2,000 characters left

We use this only to consider you for this role, and delete it after 12 months.