Company Overview

Allium is building the System of Record for Onchain Finance. We ingest, verify, and standardize data across 140+ blockchains and 30+ petabytes of history to close four structural gaps:

Semantic Gap: Translating raw events into financial concepts like payments, trades, deposits, and staking income
Standardization Gap: Mapping thousands of protocols into a single canonical cross-chain schema
Infrastructure Gap: Read-optimized, globally distributed data at web scale
Accountability Gap: Auditable methodology, SLAs, and SOC 1 and 2 compliance

Our customers include Visa, Stripe, G-SIB banks, Big 4 accounting firms, BCG, Coinbase, Phantom, Uniswap, and we are cited by the Federal Reserve.

Who We Serve

Finance, Accounting, and Risk Teams — Reliable, audit-grade answers for financial reporting, reconciliation, compliance, risk monitoring, and defensible metrics
Engineers and Product Teams — Low-latency, production-ready infrastructure for wallets, trading systems, payment rails, staking infrastructure, and real-time applications
Strategy, Research, and Executive Teams — Clarity on ecosystem economics, market structure, user behavior, competitive dynamics, and capital flows
AI Agents — Structured data, attribution, condition checks, and auditability for autonomous onchain transactions

About the Role

We are hiring a Security Engineer to build and operate the controls that protect Allium's infrastructure, applications, employee systems, and use of AI. You will work closely with Engineering and the person leading our security program to investigate threats, implement practical fixes, and automate security work.

As AI agents gain access to code, data, and tools, security must cover both human and machine activity. You will help secure how agents operate while strengthening defenses against automated attacks, credential theft, and compromised software dependencies. This is a hands-on engineering role: you will write code, test controls, investigate real signals, and take findings through remediation.

Responsibilities

Secure cloud infrastructure and access — Implement least privilege, phishing-resistant authentication, short-lived credentials, controlled privileged access, and reliable provisioning and deprovisioning. Improve cloud configuration, managed credential storage, and network protections with service owners. Improve secrets scanning and prevent credentials from entering source control.
Secure AI agents and developer tools — Help implement permissions, execution isolation, network restrictions, and audit trails for coding assistants, agents, and tool integrations, including MCP. Test how untrusted content could trigger prompt injection, tool misuse, or unintended data access, and build safeguards at the point where actions execute.
Build detection and response — Correlate identity, cloud, workload, and CI/CD telemetry to detect credential theft, unusual access, unauthorized agent actions, suspicious software changes, and data exfiltration. Investigate attacks across systems, reduce alert noise, and test response procedures with system owners, including session revocation, exposed-credential rotation, and removal of unauthorized access.
Reduce software supply-chain risk — Assess dependencies, CI/CD workflows, third-party integrations, and developer environments. Partner with engineers to validate findings, protect build and deployment credentials, and remediate vulnerabilities.
Move quickly on relevant threats — Maintain visibility into internet-facing services, including developer tools and management interfaces. Evaluate new vulnerabilities and active exploitation against our actual exposure. Help patch, isolate, revoke credentials, or apply compensating controls with service owners, then verify that the response worked.
Automate and document — Use code and APIs to improve access reviews, configuration checks, evidence collection, and remediation tracking. Use AI thoughtfully for security work, validating its output and protecting sensitive data.
Support employee security and enterprise assurance — Deploy, validate, and maintain endpoint protections and device security baselines, including prevention settings, tamper protection, encryption, and timely updates. Work with the owner of employee IT on identity and SaaS controls. Provide clear technical evidence for audits and customer reviews, and maintain useful runbooks.

Requirements

Typically 4+ years of relevant security, infrastructure, or software engineering experience, with direct responsibility for implementing security controls
Hands-on experience with a major cloud platform and a strong foundation in identity, networking, operating systems, and access control
Depth in at least two relevant areas, such as cloud security, detection and response, application security, vulnerability management, or corporate security
Experience investigating technical problems from logs and system behavior, testing hypotheses, and following issues through to resolution
Clear communication, practical judgment, and constructive working relationships with engineers and business teams

Values

Obsessiveness — Depth of care for correctness; cannot tolerate work that ships half-right
Pro Athlete Mindset — Consistency and day-in, day-out pursuit of excellence
Figure It Out & Extreme Ownership — Resourcefulness over resources; learn, find, or build what is needed
High Agency — Responsiveness and effective problem-solving
Leading from the Front — Prove the way by building, not just suggesting
Strong Opinions On the Future (loosely held) — Pride in continuously improving everything
Sense of (Allium) Business Smell — Naturally connect work to leverage for teammates and business goals

Team

We invite people of all backgrounds. Our engineers come from varied paths — some learned coding later in life or on the side, some are still in school, others attended top institutions (CMU, Stanford, UIUC, UPenn, Oxford, NUS, Cornell). All are welcome with a curious mind and infectious work ethic.

Benefits

Medical, Dental, Vision, Life and AD&D insurance — US employees receive 100% coverage for Gold plans, 80% for dependents
Ownership — Meaningful early-stage equity; every full-time employee receives a stock option grant
Time off — Flexible, trust-based paid time off; policies meet or exceed local statutory vacation requirements in every country we hire
Retirement — Company-sponsored 401(k) plan in the US for pre-tax long-term savings

Application Note

All applicants must answer this pop quiz: "What is an Allium? What is your favorite Allium?" (reference: https://www.allium.so/post/how-allium-got-its-name). Bonus points for the right pronunciation.

Imported from Allium’s job posting on jobs.ashbyhq.com. Apply sends you to the original listing.

Security Engineer