Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 42 hours ago

Cybersecurity Engineer

SemiAnalysis51 open roles

Where
New York City, NY
Work mode
Hybrid
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowCybersecurity EngineerSemiAnalysis · New York City, NY

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on SemiAnalysis's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.6% of postings close within 7 days. Measured by our own scanner across the market. SemiAnalysis postings stay open a median of 5 days.

Share of postings closed within
  1. 2.3%1 day
  2. 4.7%3 days
  3. 13.6%7 days
  4. 21.9%14 days
  5. 36.9%30 days
  6. 59.0%60 days
This job: posted 42 hours ago

SemiAnalysis median: 5 days open

The posting

Employment Type: Full-Time Work Setting: In-office / Remote Work Location: United States Work Hours: Office hours Find out more here: https://semianalysis.com

About SemiAnalysis

SemiAnalysis is an independent research and analysis firm specializing in the Semiconductor and AI industries. Our in-depth coverage spans the entire supply chain, from semiconductor fabrication processes to cutting-edge AI Models, software, and infrastructure. We are recognized as the leading authority on the semiconductor supply chain, with the highest concentration of industry experts within one team, and a deep-rooted passion for delving into the intricacies.

We are a global team of analysts, each with extensive networks across the semiconductor supply chain and AI ecosystem, publishing industry shaping articles while participating in numerous conferences annually.

Our newsletters reach more than 200,000 subscribers worldwide, including senior management and c-suite leaders at the leading semiconductor and AI companies.

We also offer three core products:

  • Industry Models – we develop and publish industry models on accelerator shipments, datacentre demand and supply, GPU total cost of ownership, and more. We work with hyperscalers, neoclouds, many of the world’s largest hedge funds, and government agencies.
  • Core Research – our public equity markets product, geared towards financial investors, distils our deep technical research and knowledge into key insights on technology and product trends.
  • Consulting and Technical Due Diligence – We conduct custom research and project work to guide key strategic and investment decisions for the largest private equity funds, leading venture capital firms, companies across the AI ecosystem, and government agencies.

Position Overview

SemiAnalysis is hiring its first dedicated Cybersecurity Engineer, covering both SemiAnalysis and Citrini. You will own the security of two research businesses end to end: our paywalled publications and datasets, our subscriber and billing data, our internal models and code, and the people who are the most likely way in. We want someone who attacks our own surface area continuously, then fixes what they find. This is a hands-on, one-person security function for now, reporting to leadership, with budget for tooling and outside specialists if needed.

Responsibilities

  • Run a continuous offensive program against SemiAnalysis and Citrini: build an automated, LLM-driven red team (uncensored or open-weight models, agentic tooling) that probes our web properties, paywall, APIs, email, cloud accounts and staff around the clock, and triage what it surfaces.
  • Harden identity and access: enforce phishing-resistant MFA (hardware keys) for every account that matters, least-privilege admin on Google Workspace, Slack, GitHub, Stripe, SubStack and cloud, and kill shared credentials.
  • Protect the product: secure the paywall and subscriber data, detect credential sharing and scraping of paid content, watermark or fingerprint distributed reports, and monitor for leaked reports on Telegram, Discord, forums and dark-web markets.
  • Defend against insider and departure risk: DLP and egress controls on models, datasets and code; device management; a clean offboarding playbook; evidence preservation that stands up in trade-secret litigation.
  • Own people security: targeted phishing and vishing simulations against staff and founders, executive impersonation controls (deepfake voice, fake wires, fake interview requests), and short practical training.
  • Secure the engineering surface: GitHub org settings, secrets scanning, dependency and CI hygiene, cloud configuration review across our research and InferenceX work.
  • Build detection and response: centralise logs from SaaS and cloud, write alerts, run incident response, and own vendor relationships (MDR, pentest, forensics, cyber insurance).
  • Own disaster recovery and business continuity: define recovery objectives for our publications, datasets, subscriber systems and code; put tested, offline-capable backups in place for every critical system; write and run recovery playbooks for ransomware, account takeover and SaaS or cloud outages; and run at least one restore and tabletop exercise a year.
  • Report to leadership quarterly on risk, with a prioritised roadmap and a budget.

Requirements

  • 2+ years in security with real defensive or offensive experience: red team, blue team, penetration testing, bug bounty or adversary simulation, with findings you can walk us through.
  • Hands-on with LLM tooling for security: you have built or run agentic attack or recon pipelines, understand prompt injection and model abuse, and can run open-weight models yourself.
  • Strong on identity and SaaS security: Google Workspace, Okta or similar, Slack, GitHub, Stripe, cloud IAM (AWS or GCP). You know where small companies get breached.
  • Practical backup and recovery experience: you have restored systems after an incident or outage, not just configured the backups.
  • Comfortable being the whole function: you can scope, build, operate and explain, and you know when to bring in outside help.
  • Can read and write code (Python at minimum) well enough to automate your own work and review ours.
  • Clear writer. Our business is written analysis; your incident reports and roadmaps will be read by the founders directly.

Preferred skills

  • Experience defending a media, newsletter, data vendor or investment research business: paywall abuse, content leakage, scraping.
  • Insider-threat or DLP work, or involvement in trade-secret or IP litigation evidence.
  • Threat intelligence on financially motivated groups (ShinyHunters, Scattered Spider, Silent Ransom Group) and dark-web monitoring.
  • OSCP, OSEP, GIAC offensive certs, or a track record on HackerOne or Bugcrowd.
  • Familiarity with the semiconductor and AI infrastructure world, or with quant and hedge fund security expectations.
  • Experience with hardware or GPU-cluster environments, since some of our work touches lab and inference hardware.

Potential growth areas

  • Build the function: as the business grows, hire and lead a small security team across both brands and own the budget.
  • Product security: shape how our data products, APIs and open-source work (including InferenceX) are built securely from the start.
  • Research and writing: contribute security analysis to our published work on AI infrastructure, data centres and the semiconductor supply chain, and write cybersecurity articles for the SemiAnalysis SubStack, with our audience behind you.
  • Leadership exposure: work directly with the founders and present risk to the board, with a path to Head of Security.

SemiAnalysis LLC participates in the E-Verify program to confirm the employment eligibility of all newly hired employees. For more information, visit e-verify.gov.

  • E-Verify Poster: https://www.everify.gov/sites/default/files/everify/posters/EVerifyParticipationPoster.pdf
  • Right to Work Poster: https://www.justice.gov/crt/case-document/file/1133936/dl?inline=
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against SemiAnalysis's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on SemiAnalysis's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    SemiAnalysis's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.