See 🚩 Candidate Hard Gates & Red Flags for company-wide eligibility rules (B2B, location default, English, compensation-expectations screening). What follows is specific to this role, including the daily-exposure NSFW note below.
Daily work involves NSFW exposure on Candy.ai. Do not submit candidates unless NSFW comfort has been explicitly confirmed on a call.
⛔️ Top Requirements
- Practical, hands-on security ownership — not a compliance-only seat.
- Git/GitHub fluency — comfortable shipping code and working within engineering workflows, not just reviewing from the outside.
- Scripting/automation skills — Python/Bash or equivalent.
- Prior experience at another AI company or a scale-up (50+ employees).
- CET timezone overlap (~80%) — required for daily collaboration.
- Comfortable with occasional nights & weekend security monitoring/on-call coverage.
🎯 What We Are Hiring For
A hands-on Security Engineer to own application security, GRC, and security awareness — not a compliance-only seat. You'll code-review, drive vulnerability remediation, build out the risk register, coordinate external audits/pentests, and carry occasional weekend monitoring coverage, with real ownership from day one.
Reports directly to Robin Razzi (QA Lead), who brings hands-on security experience and can go deep on technical topics; Michael Monin (CTO & Co-founder) is also a stakeholder on this hire. The candidate will be the sole dedicated security hire — comfortable owning the function independently day-to-day. Broad security generalist seat spanning Application Security, GRC, Security Awareness, IT/Access Management (MDM, provisioning), and emerging AI-specific threats — not a single-specialty role.
⛔️ Screening Criteria
- Practical ownership — can distinguish "I identified / implemented / fixed / improved" from "the security team was responsible for." The hands-on, code-reviewing, remediation-driving profile above is what's being tested, not theoretical knowledge.
- Application Security — practical involvement identifying, prioritizing, and resolving security issues, not just familiarity with concepts.
- GRC / security governance — experience building or maintaining a risk register and coordinating external audits/pentests, proportionate to this being one part of a broader generalist scope, not the whole role.
- Risk judgment — can identify meaningful risks, prioritize them, explain trade-offs, and determine proportionate remediation.
- Company-stage fit — 2–3+ years hands-on security experience (application security, GRC, or a mix); flexible on years given AI-startup intensity (e.g. ~1 year at Candy can weigh like ~3 years elsewhere).
- "Hacker" mindset — independently experiments, breaks things, researches vulnerabilities, and builds original security projects outside of formal processes.
AI usage is a positive signal for this role, not a hard requirement. Awareness of emerging AI-specific threats is part of the broader scope; hands-on use of AI tools (code review, vulnerability research, workflow automation) is useful evidence of the "hacker" mindset above, but its absence is not disqualifying — unlike Ruby Engineer, Product Designer, or Senior Product Manager, where it is mandatory.
Also confirms NSFW comfort (explicitly, before submission — see the callout above) and CET overlap / weekend on-call comfort. Security Awareness and IT/Access Management (MDM, provisioning) are part of the role's broader scope; probe them lightly rather than as separate deep-dive gates.
🚩 Red Flags
- Security experience is almost entirely theoretical.
- Purely audit/compliance profile with insufficient practical/hands-on security work.
- Cannot explain personal ownership — relies on "we"/"the security team" rather than personal contribution.
- Cannot give concrete examples of security issues personally identified/resolved.
- Cannot prioritize risk or explain trade-offs.
- Overly process-heavy approach with no evidence of implementation.
- No Git/engineering fluency — cannot operate inside engineering workflows.
- Not comfortable with weekend/on-call coverage or the required CET overlap.
- NSFW comfort is hesitant.
Do not reject candidates merely for coming from consulting, a smaller company, or a particular security specialty — assess practical ownership and evidence on their own merits.
💬 Recruiter Screening Questions
Use these questions during your screening call. Include a summary of the candidate's answers in your submission notes in Ashby.
- What are your main responsibilities in your current security role, and why are you considering a move?
- Have you seen Candy.ai? Our product operates in the AI companionship space and generates adult/NSFW content — are you fully comfortable working with this content on a daily basis?
- Walk me through a security risk or vulnerability you personally identified and resolved (explain it to me as if I'm not technical).
- What did you personally do, versus what the wider team handled?
- Have you worked with external security auditors or penetration-testing firms before?
- What tools or platforms have you used for vulnerability management, code review, or GRC/risk tracking?
- If you joined a company with no risk register or documented risks, how would you start? (Note the answer for technical review, no need to judge quality yourself.)
- Tell me about a time you had to balance a security risk against a product or business constraint — how did you decide, and what happened?
- How do you think about securing AI-enabled products, or have you encountered AI-specific security risks? Do you use AI tools yourself (for code review, vulnerability research, or workflow automation)?
- Are you comfortable with a role that includes occasional nights & weekend monitoring/on-call coverage?
- Location / compensation expectations / notice period / B2B?
- What questions do you have for me?
🎯 Strong Signals / Sourcing Guidance
Positive signals — not automatic hard gates:
- Application/product security engineers from AI startups that scaled up (ideally 100–500 person scale-ups).
- Comfortable being the sole or most senior security voice.
- Hands-on use of AI tools (code review, vulnerability research, workflow automation) — evidence of the "hacker" mindset, not required.
- Broad security ownership across AppSec/GRC/awareness/access rather than a single specialty.
No approved target-company list yet. Source based on the profile above (AI startups at scale-up stage where the candidate was the sole/most senior security voice, or hands-on AppSec/GRC experience at a security tooling vendor). Confirm with Robin before treating any specific company list as validated. Target companies are a sourcing aid only — a candidate from an unlisted company is assessed on the same bar.
🔄 Interview Process
Follows the shared default process — see ⏳ Hiring Process for details on each stage.