Security Engineer

About the role

Keep Troupia and its customers safe: our agents reach the tools and data of businesses and organisations on their behalf, and that has to be safe at every layer.

What you will do

• Threat-model new features before they ship, and review code and designs with the team.
• Secure identity and permissions: OAuth, API keys, secrets and row-level security (RLS) in Postgres.
• Handle the risks of AI agents: prompt injection, data leaks, and actions that need human approval.
• Lead monitoring and incident response, and the path to standards such as SOC 2 and ISO 27001.

What matters to us

• 4+ years in security for a SaaS or cloud product.
• Deep knowledge of OAuth 2.0 and OIDC, secrets management and permissions.
• Reading and writing TypeScript; familiarity with Next.js and Node.js.
• An understanding of security risks in AI systems and agents.

Nice to have

• Experience preparing for SOC 2 or ISO 27001.
• Vercel, Supabase and PostgreSQL.
• Penetration testing experience.

What you will work with

• TypeScript
• Next.js
• Node.js
• PostgreSQL
• RLS
• OAuth 2.0
• OIDC
• Better Auth
• Nango
• MCP
• Vercel
• Supabase

Your first 90 days

1. 30

   Month one: map the system (data, permissions, secrets and connections) and rank the risks.

2. 60

   Month two: close the first risks, and add security checks to every change.

3. 90

   Month three: lead the security plan for the year ahead, including the path to SOC 2.

About Troupia

We are building a team of AI agents that does the day-to-day work of businesses and organisations, beside the people in them. The product is live, in eight languages, and the team is small: whoever joins now shapes where it goes.

How we hire

1. 1A short intro call.
2. 2A professional conversation with the people you will work with, sometimes with a short task.
3. 3A meeting with the founder.
4. 4An offer. And at every step, you get an answer, even when it is no.