Senior Security Engineer (AppSec, Cloud & Incident Response)

About the role

Gelato, an AI-first, cloud-native platform connecting e-commerce businesses to print production partners, is hiring a Senior Security Engineer to join a small information security team. You will build agents and automation that review engineering work alongside AI-generated code, secure the agents' own builds, and act as the bridge between information security and engineering. The role covers application security, cloud and identity, and detection and response.

Key responsibilities

• Build and operate agents for code and change review, alert triage, finding validation, investigation summaries and routing to owners, connected safely to internal systems with least privilege, audit logs and human approval for risky actions
• Own SAST, SCA, secret, container and IaC scanning tuned to engineer trust; threat-model new services and AI features early and build paved-road defaults such as libraries, templates and CI checks
• Audit cloud and container platform security (least-privilege IAM, guardrails, cluster hardening, runtime detection, IaC) and manage identity provider roles, clients and access reviews
• Monitor through the SIEM, scan the attack surface and lead incidents end to end, including containment, investigation, communication and a blameless write-up
• Write response playbooks that agents run for routine steps and escalate to a person when judgement is needed, and share an on-call rotation
• Explain risk plainly to engineers, product and leadership and give prioritised, concrete fixes

Required profile

• 5+ years in security engineering, AppSec, cloud security or incident response
• An AI-native way of working: hands-on experience building with LLMs (agents, tool calling, RAG or MCP), knowing where they fail and using AI tools every day (hard requirement)
• Solid foundations in application security, the secure SDLC and incident response, with deep expertise in some of them
• Ability to earn engineers' trust with plain explanations, practical fixes and pragmatic trade-offs
• Fluent written and spoken English

Required skills

• Hands-on experience securing a major public cloud (AWS preferred, Azure or GCP also accepted), Kubernetes and infrastructure as code
• Solid web, API, OAuth 2.0 / OIDC and IAM fundamentals
• Production-quality code in Python, Go or TypeScript, with a habit of automating over repeating
• Nice to have: offensive security, AI red-teaming, threat hunting, SIEM and SOAR experience, and certifications such as OSCP, OSWE or GCIH