Senior Security Engineer

Gelato operates the world’s largest network for on-demand production of customized products, ranging from apparel and wall art to mugs, books, and cards. As an AI-first, cloud-native platform with no physical assets, Gelato connects e-commerce businesses to over 250 partners across 32 countries, reaching more than 5 billion people within 72 hours. The company’s ecosystem includes GelatoCreate, GelatoConnect—an AI-driven print production operating system—and Optimalprint, a consumer brand active in over 20 markets. Together, they serve thousands of merchants, production partners, and millions of customers, handling sensitive data, designs, and brands with care.

At Gelato, AI is central to how the company operates and secures its platform. Engineers leverage large language models (LLMs) for code generation, testing, and documentation, while autonomous agents enhance platform resilience, observability, and workflow automation. The security team similarly employs AI for alert triage, threat analysis, and response orchestration. AI agents are deeply integrated into GelatoConnect and the core platform, performing tasks such as product catalog mapping, file validation, and integration code deployment. This extensive use of AI presents unique security challenges that the team addresses without hindering innovation.

This role goes beyond traditional analyst duties. Instead of manually reviewing dashboards, you will develop AI agents and automation tools that assist engineers by reviewing code and changes securely. You will ensure the AI agents themselves are secure and act as a vital link between information security and engineering teams. Joining a small, agile security team, you will work across application security, cloud and identity management, as well as detection and response. While expertise in all areas is not required, strong skills in some and a willingness to grow in others are essential.

Key Responsibilities

- Automate with AI: Design and operate AI agents for code and change reviews, alert triage, validation, investigation summaries, and routing. Ensure secure integration with internal systems using least privilege principles, audit logging, and human approvals for sensitive actions. Continuously evaluate agent performance and retire ineffective ones.

- Secure the SDLC: Manage static application security testing (SAST), software composition analysis (SCA), secret scanning, container and infrastructure-as-code (IaC) scanning. Build trust in security signals by tuning tools, threat-model new services and AI features early, and develop secure defaults such as libraries, templates, and CI checks to prevent common vulnerabilities.

- Secure Cloud and Identity: Assess and audit cloud and container platform security, focusing on least-privilege IAM, guardrails, cluster hardening, runtime detection, and IaC. Collaborate with the Platform team on implementation. Manage identity provider roles, client access reviews, and maintain consistent authentication and authorization across services.

- Detect and Respond: Monitor security information and event management (SIEM) systems, scan attack surfaces, and lead incident response from containment through investigation and communication to blameless post-mortems with actionable fixes. Develop automated response playbooks that escalate to humans when necessary. Engage in proactive threat hunting and share on-call duties.

- Partner with Engineering: Communicate risks clearly to engineers, product teams, and leadership. Provide prioritized, practical remediation recommendations with transparent reasoning and documented trade-offs.

Required Qualifications

- Minimum 5 years of experience in security engineering, application security, cloud security, or incident response.
- Hands-on experience building with large language models (LLMs), including agents, tool calling, and retrieval-augmented generation (RAG). Daily use of AI tools with a strong understanding of their limitations is mandatory.
- Practical expertise securing major public clouds (AWS preferred; Azure or GCP acceptable), Kubernetes, and infrastructure as code.
- Solid foundation in application security, secure software development lifecycle (SDLC), and incident response, with deep knowledge in at least some of these areas.
- Proficiency in production-quality coding with Python, Go, or TypeScript and a strong automation mindset.
- Ability to build trust with engineers through clear communication, practical solutions, and pragmatic decision-making.
- Fluent written and spoken English.

Preferred Qualifications and Benefits

- Experience in offensive security such as penetration testing, bug bounty programs, capture-the-flag (CTF) competitions, or published research.
- Knowledge of AI red-teaming or OWASP Top 10 for LLM applications.
- Skills in threat hunting, forensics, or malware analysis.
- Familiarity with SIEM and SOAR/workflow automation platforms.
- Experience managing open-source identity providers, Kubernetes runtime security, or policy-as-code.
- Certifications like OSCP, OSWE, GCIH, or cloud security credentials are a plus but not required.

Gelato is a customer-focused company driven to revolutionize the printing industry with sustainable technology. The team values passion, entrepreneurial spirit, and a strong alignment with company values. With 11 offices worldwide, Gelato fosters a collaborative and diverse work environment, encouraging employees to work from the office at least three days a week to build meaningful connections. Candidates are requested to submit their CVs in English.

As part of the hiring process, candidates who accept an offer will undergo a background check conducted by a third-party provider.