InstaLILY

InstaLILY

Director, Security Engineering

New York City · Full-time · Director

Sponsorship not specified$30k-$50kDetected 8 days ago
TypeScriptPythonNext.jsSQLPostgreSQLAWSGCPAzureKubernetesTerraformGrafanaDatadogSite Reliability EngineeringRESTLLMsAgentic AICybersecurityIncident ResponseComplianceLogisticsHIPAALeadershipCISSP

Stay score

odds of building a lasting career here

39Risky
Cap-exempt (no lottery)0
Sponsors this role90
Entry-level history0
PERM / green-card track0
Lottery odds (Level I)39
Fits your clock70

Thin sponsorship signal and lottery-bound (~15% per draw). A low-probability bet with your clock running. Prioritize cap-exempt roles and proven entry-level sponsors first.

Lottery odds assume a STEM candidate.

Personalize to your clock →

Community outcomes

No reports yet — be the first to help the next applicant.

About the role

  • We're hiring our first dedicated security leader, reporting directly to the CEO.
  • Lily operates inside the systems of some of the largest enterprises in distribution, construction, healthcare, and logistics.
  • That makes security a core part of the product and a lever on every enterprise deal we close.

Responsibilities

  • Own Customer Trust: Run enterprise security reviews end to end. Build one source of truth for security answers, launch a trust center and security package, and lead CISO and InfoSec calls, audits, and RFP security sections, often on short notice.
  • Run the Compliance Program: Keep SOC 2 Type II and HIPAA healthy in Drata: continuous control monitoring, policy refreshes, and access reviews. Lead us through our next audit window and stand up a GDPR program.
  • Harden the Cloud: Partner with SRE to prioritize and close critical and high cloud findings. Make org-level guardrails the default: org policies, secrets management, and least-privilege IAM across GCP and AWS.
  • Test and Respond: Commission and run our independent pen-test program and drive remediation. Refresh the incident response plan, run tabletop exercises, and serve as the escalation point for security incidents.
  • Set the Operating Model: Decide whether to partner with a vCISO or GRC service for paperwork-heavy work, complete the CNAPP evaluation, and deliver a 12-month security roadmap to the CEO and leadership.
  • Grow the Function: Hire and lead 1-2 security or AppSec engineers as the program scales.

Requirements

  • 8+ Years in Security Engineering: Including hands-on ownership of a security or compliance program at a SaaS company, ideally at the Series B-C stage.
  • You can threat-model a multi-tenant, multi-cloud architecture and review code, not just run scanners.
  • Real LLM Experience: You've built something real with LLMs and understand how agentic systems change the threat model.
  • Experience with multi-tenant isolation, pen-test programs, Okta or IdP rollouts, and CNAPP tooling such as Wiz or Aikido.
  • Familiarity with GDPR, ISO 27001, HITRUST, NIST CSF, or the EU AI Act.
  • None are required.

Nice to have

  • End-to-End SOC 2 Type II Ownership: You've run the program yourself: audits, controls, evidence, and GRC tooling.
  • You treat compliance as real risk reduction.
  • HIPAA experience is a strong plus.
  • Player-Coach Mindset: You're energized by doing the work yourself.
  • San Francisco considered for exceptional candidates.
  • Travel: Minimal.
  • Occasional customer onsites or audits, plus periodic trips to New York if based in San Francisco.

Compensation

  • $200,000 - $250,000 per year, commensurate with experience
  • An annual independent pen test completed, with critical findings remediated within SLA.

Benefits

  • Medical, Dental, Vision, 401K, in-office lunch reimbursement, Wellness Stipend, generous parental leave, PTO and 10 US Federal Holidays, and more!

Company info

  • We serve some of the largest operators in our industries, including SRS Distribution (part of The Home Depot family), United Rentals, and Henry Schein, and we work closely with the Google DeepMind and NVIDIA ecosystems.
  • How We Work We work in small teams with real ownership: clear problems, direct access to the customers whose work you're changing, and room to ship.
  • Everything runs on three principles: Customers, Culture, and Code.
  • You'll also be the face of security to enterprise customers, spending roughly 25-30% of your time on CISO calls, audits, and security reviews.
  • Secure the Agents: Build security into Lily from the start: threat models, prompt-injection defenses, tenant isolation, agent authorization, and security checks in CI as part of a secure SDLC.

Equal opportunity

  • If you require an accommodation, please let us know, and we will work with you to meet your needs.

Visa & Work Authorization

  • If you'd like to opt out, please contact our recruiting team ( lily.hiring@instalily.ai ).
Apply directly at InstaLILY →Create a free account for alerts like thisView InstaLILY immigration profile

This listing is sourced directly from InstaLILY's careers page and normalized into a canonical job model.