The posting
The problem, stated plainly
The scarcest resource in security is not information. It is attention. Your employees do not click phishing links because they are careless; they click because the attacker priced their attention better than the training did. Most security training is a compliance ritual. Everyone knows this, and almost no one says it out loud.
Cimento AI is fixing that. We use AI to build security training that actually changes behavior: adaptive phishing simulations, employee risk scores that mean something, and campaigns a security team can run without a services engagement. We are backed by operators and angels from Cloudflare, CrowdStrike, and Okta, and we already work with some of the most demanding buyers in the market: Together AI, Gemini, Exa AI, DigitalOcean, and others who will fire us the moment the product stops earning its keep. We consider that a feature.
We value creative spark over credentials, and high agency over process. If your portfolio tells a story about how you think, we want to talk. If your résumé is impressive but your portfolio is not, we probably don't.
Why this role is underrated
Founding designer at a ten-person company is, in my view, one of the most underpriced jobs in technology right now. Consider the model:
- Security software is data-heavy, workflow-heavy, and almost uniformly ugly. The marginal return to taste in this category is enormous precisely because so little of it exists.
- You will not inherit a design system, a brand, or a process. You will inherit a blank page and real customers. The blank page is the compensation.
- AI tools have collapsed the cost of execution. What has not collapsed, and has in fact appreciated, is judgment about what to execute. Context is that which is scarce. You will have all of it.
Average is over for design generalists at big companies. It is very much not over for a designer who can move from strategy to shipped screens without waiting for permission, and who uses AI to work at a pace that should not be possible for a team of one.
The AI agents extension
Here is the part most candidates will underrate. The attackers already use AI agents; they craft the lure, pick the target, and adapt to what worked, at a marginal cost approaching zero. Training built on static templates and an annual quiz is bringing a pamphlet to that fight. So we are building AI agents into the core of the product: agents that run the red-team side of security awareness: crafting simulations as convincing as the real thing, adapting each campaign to the individual employee and to what your organization keeps falling for, and turning the results into risk scores a security team can actually act on. The human security team sets intent; the agents do the volume.
Solve for the equilibrium: when offense is automated and defense is a slide deck, the gap only widens. Closing it is the product. For a designer, this is the interesting part: how do you make a security lead comfortable delegating to an agent, show what it did and why, and keep the human confidently in charge of an automated system? Those interfaces do not have conventions yet. You would be inventing them.
What you will actually do
You will own product design end to end: discovery, wireframes, high-fidelity UI, shipped screens. You will design how security teams configure campaigns, launch phishing simulations, monitor results, and act on employee risk scores — the whole workflow, including the unglamorous parts: permissions, edge cases, error states, the operational middle that separates products people tolerate from products people trust. You will build the design system (components, patterns, tokens) that the next ten hires inherit. You will sit with customers, validate designs early, and fold what you learn into rapid iteration. You will shape Cimento's visual identity across product, marketing, and sales. And you will use AI design and prototyping tools not as a gimmick but as leverage, to compress timelines and expand your range.
Who should apply
You have four or more years of product design experience, with meaningful time at startups where you owned the full design surface. Your portfolio shows strong UI craft, clear UX thinking, and a feel for making data-heavy products simple. You have a track record of shipping: not just designing, but getting work into users' hands and iterating on what you learn. You are comfortable close to engineers and fluent in frontend constraints. You communicate well, default to transparency, and treat ambiguity as raw material rather than a grievance.
Bonus points for experience in cybersecurity, enterprise security, or compliance software, and for hands-on prototyping with AI tools (Claude Design, Figma AI, or similar).
How we work
A few facts about the culture, offered without adornment. We work hard, in the way early-stage companies must, and we see no reason to pretend otherwise. At the same time, we do not take ourselves seriously; the work is serious, we are not, and confusing the two is how companies become insufferable. We measure outputs, not inputs: nobody counts your hours, your Slack response time, or your seat time, because none of those things ship product. And nothing performative survives here: no theater standups, no decks made to look busy, no working late so someone notices. If a ritual does not produce anything, we delete the ritual. You would be surprised how much this one policy explains.
A few questions to ask yourself before applying
- What is the most beautiful piece of enterprise software you have used, and why do you think it is so rare?
- What do you practice, in design, that is the equivalent of a musician's scales?
- What is something you believe about how security products should look and feel that most designers would find absurd?
If you have crisp answers, we would like to hear them.
What we offer
Meaningful equity as an early team member, a competitive salary, and direct influence on product, customers, and company direction. A ten-person team where your work is visible, valued, and shipped, often within the week you designed it.
