The posting
BOLD is looking for a Director of Security to own security across a large portfolio of client-facing products. Our products run on AWS and Azure, ship at high velocity across UI and backend, and make extensive use of AI and LLMs across the customer experience.
This is a builder's role, not an audit role. You will design security into our architecture, our delivery pipeline and our AI features, and lead the team that keeps it there. Compliance, certifications and penetration testing are part of the remit, but they are outcomes of a well-run program, not the program itself.
We want someone who has already thought hard about what changes when a product talks to a model: prompt injection and hijacking, data leaking through model context, agents with too much authority, and attackers who now use AI too.
+ What you'll be securing:
Layer
What we run
What we need from you
Cloud
AWS and Azure, multi-account / multi-subscription
One identity, policy and posture model across both clouds
Compute
Kubernetes (EKS / AKS), containers, CI/CD
Supply-chain integrity, runtime detection, least-privilege workloads
Edge
CDNs, WAF, bot detection agents
Tuned defences against scraping, credential stuffing and AI-driven bots
APIs
Public and partner APIs behind API protection
Discovery, schema enforcement, abuse and BOLA/BFLA detection
Applications
Modern web front ends and backend services
Secure-by-default frameworks and paved roads for engineers
AI
Extensive use of AI and LLMs in client-facing features
An LLM threat model, guardrails, evals and monitoring in production
ABOUT THIS TEAM
BOLD Platform services team design, creates, manage and maintains the highly scalable and distributed services for the wider use of web and mobile product applications/portals/websites. The current list of services is based on Microservices architecture whose domain ranges from visitor tracking, User profiles, authentication, content and payments.
Platform team uses state of the art modern technologies like .Net framework, Python, Java, SQL Server, My SQL, Graph DB, SOLR, and a lot of other tools & technologies serving millions of users with hundreds of million transactions everyday through a scalable and fault tolerant architecture.
WHAT YOU’LL DO
- AI and LLM security: Own the threat model for every AI/LLM-powered feature, covering prompt injection and prompt hijacking (direct and indirect), jailbreaks, system-prompt and data leakage, insecure output handling, excessive agency in tool-calling, and model denial-of-wallet.
- AI assurance: Build adversarial evals and red-team exercises for AI features into the release process, with production monitoring for abuse and drift. Govern internal AI use, including coding assistants, agents with repo or cloud access, plugin integrations and shadow AI.
- Multicloud security: Set a unified security architecture across AWS and Azure: identity federation and guardrail policies. Harden Kubernetes with admission control, network policy, workload identity and runtime threat detection.
- Edge defences and real-time tuning: Own edge security across every client-facing product, working with Architecture and Technical Operations on real-time tuning of DDoS mitigation thresholds, rate limits, bot-score and challenge thresholds, and WAF rule sensitivity, balancing attacks blocked against false positives for real customers.
- API security: Run an API security program covering inventory of every endpoint, authentication and authorization patterns, rate limiting and abuse detection.
- Secure engineering: Build paved roads so the secure way is the easy way. Embed SAST, SCA, secrets and IaC scanning and SBOMs in CI/CD, secure the software supply chain, and lead design reviews and threat modelling as a peer to architects.
- Detection and response: Own detection engineering and incident response across cloud, Kubernetes, edge and AI layers, including runbooks for AI-specific incidents, tabletop exercises and post-incident reviews.
- Tooling and budget: Own the security tooling budget: build business cases, rationalise overlapping tools, negotiate with vendors and track spend against risk reduced. Partner with Architecture and Technical Operations on tooling decisions from evaluation to rollout, and agree who owns which detection thresholds during a live attack.
- Governance and compliance: Set direction for governance, risk and compliance, working with our in-house GRC team, which owns day-to-day delivery. Ensure compliance with GDPR, PCI DSS and the EU AI Act is a byproduct of engineering controls, with automated evidence.
- Risk and assurance: Make the calls on high-impact third-party risk, especially AI providers. Scope and direct penetration tests and bug bounty, and represent security to enterprise clients on strategic deals.
- Leadership: Build and lead a small, high-leverage team (application, cloud and AI security), work closely with our in-house GRC team, grow security champions inside engineering, and report risk posture and program metrics to executive leadership in plain business terms.
WHAT YOU’LL NEED
- 12+ years in security, including 4+ years leading a security function in a product engineering organisation with a multi-product, client-facing portfolio, including ownership of its tooling budget.
- Hands-on depth in cloud security on both AWS and Azure; able to read an IAM policy, a Terraform plan and a Kubernetes manifest and spot the problem.
- Practical experience securing AI/LLM-powered features in production, including defending against prompt injection and hijacking.
- Strong application and API security background: OWASP Top 10 and API Top 10, OAuth/OIDC, authorization design and secure SDLC.
- Experience running and tuning edge defences in production (CDN/WAF, DDoS mitigation, bot management and API protection platforms), including threshold tuning during live traffic events.
- Detection and incident response leadership, including at least one serious incident handled end to end.
- Has overseen compliance programs such as GDPR, PCI DSS or EU AI Act readiness alongside a GRC team.
- Comfortable writing code or scripts (Python, Go or similar) to automate, prototype and review.
- Communicates risk to engineers and executives with equal clarity, and earns trust by enabling delivery rather than blocking it.
WHAT’S GOOD TO HAVE
- Has built LLM red-teaming or eval harnesses, or contributed to OWASP GenAI, MITRE ATLAS or similar work.
- Experience with AI gateways or LLM firewalls, and with securing agentic workflows.
- Background working alongside data science teams on model and data pipeline security.
- Familiarity with the OWASP Top 10 for LLM Applications and the NIST AI RMF.
- Certifications such as CISSP, CCSP, OSCP or cloud security specialties (valued, not required).
EXPERIENCE-
- Director, Security- 12years+
#LI-Hybrid
About Bold We Transform Work Lives As an established global organization, BOLD helps people find jobs. Our story is one of growth, success, and professional fulfillment. We create digital products that have empowered millions of people in 180 countries to build stronger resumes, cover letters, and CVs. The result of our work helps people interview confidently, finding the right job in less time. Our employees are experts, learners, contributors, and creatives.
We Celebrate And Promote Diversity And Inclusion We value our position as an Equal Opportunity Employer. We hire based on qualifications, merit, and our business needs. We don't discriminate regarding race, color, religion, gender, pregnancy, national origin or citizenship, ancestry, age, physical or mental disability, veteran status, sexual orientation, gender identity or expression, marital status, genetic information, or any other applicable characteristic protected by law.
Under San Francisco's Fair Chance Ordinance, qualified applicants with arrest and conviction records will be considered for the position.
