Security & Infrastructure Engineer
XBuild San Francisco, California, United States · $210K–$300K/yr
Applying here? Try the free cover letter tool — paste this posting and your résumé, no account needed.
About the role
You will serve as the first dedicated security and infrastructure hire, responsible for building and owning the security program and infrastructure footprint. This includes managing threat models, AI guardrails, compliance certifications, and developer experience to ensure a secure and efficient engineering environment.
What they look for
Requirements
The ideal candidate has experience as an early security or infrastructure owner at a growing SaaS company and is deeply proficient in GCP. You must be capable of pragmatic risk assessment, writing infrastructure code, and effectively communicating security risks to both technical and non-technical stakeholders.
Benefits
Full description
About XBuild
XBuild is building the back office that runs itself for contractors. Headquarters connects every system a contractor runs into one record of the business, and Rex, our AI operator, runs the work on top of it: building estimates and supplements from photos and measurements, chasing unpaid invoices, following up on stale leads. More than 1,000 companies doing $25B+ a year in work run on XBuild, and we've raised $25M+ from a16z and N47.
The role
You'll be our first dedicated security and infrastructure hire, and you'll own both. Contractors trust us with their customers' homes, insurance claims, photos and financials, and enterprise customers will check that we deserve it. AI makes attackers faster and gives us new attack surface: an agent that reads untrusted documents and acts on customer data. We want someone who has built a security program from zero, still writes the infrastructure code themselves, and also makes our engineers faster.
What you'll own
- Security: threat models, access control and tenant isolation, secrets, vulnerability and dependency management, detection and incident response. You'll write and test the incident plan.
- AI security: guardrails for Rex and our other agents, covering prompt injection, tool permissions, data boundaries between companies, and red-teaming.
- Compliance: run our assessments and certifications, answer enterprise security questionnaires, and join security reviews on large deals.
- Infrastructure: our GCP footprint (Cloud Run, Cloud Deploy, IAM, networking), Firebase and Firestore, infrastructure as code, cost, reliability and on-call.
- Developer experience: CI/CD on GitHub Actions, preview environments, local dev, test speed. Make the secure path the easy path for a fast-moving team.
- Company IT: identity and SSO, device management, access reviews, vendor risk.
You might be a fit if you
- Have been the first or an early security or infrastructure owner at a growing SaaS company, and took it through SOC 2 or similar.
- Are deep in at least one major cloud, ideally GCP, and comfortable across the rest of the stack.
- Have led a real incident from detection to postmortem.
- Judge risk pragmatically: you know which 10 things matter this quarter and which 100 can wait.
- Write code, and review application code for security flaws, not just infrastructure config.
- Explain risk clearly to engineers, executives, customers and auditors.
Nice to have: securing LLM agents, Firebase security rules, multi-tenant B2B SaaS, insurance or financial data.
Details: San Francisco, in office 3 days a week · $210–300k + 0.20–0.50% equity, depending on level · Medical, dental and vision insurance · 401(k) · US only; we sponsor H-1B transfers
To apply: tell us about the worst security incident you've handled and what you changed afterwards.
