Tano builds agents that run influencer marketing for brands like Hello Fresh, Bloom & Wild and Unilever. They read messages from thousands of creators, hold real tools and spend live brand budgets, around the clock. We are hiring our first security engineer to own all of it: part CISO, part the engineer who writes the fix.
One owner for security. You set the strategy, write the code and answer to the CTO.
What you would own
Everything security at Tano, with nobody between you and the work. You decide what matters, write it down and ship it, then explain it to the board and to the security teams at the brands we work with.
The hard part is the agents. They act on untrusted creator messages, call tools and move money, unattended for months. Keeping them inside clear limits on what they can do, with which data and how much they can spend, is a problem few security teams have had to solve yet.
Product security
- Threat-model the product end to end: the agents, the systems that pay creators and track their sales, and the apps brands and creators sign in to.
- Agents: guard against prompt injection from creator messages and tool misuse, and set the limits each one works within: the tools it can call, the data it can read, the budget it can spend, and the steps that need a person to approve.
- Money: protect the systems revenue depends on, from creator payouts and commission to discount codes and brand budgets, against fraud, abuse and costly mistakes.
- Data: keep each brand's data, and every creator's personal details, separate and private.
- Build the checks into the code everyone shares, so product engineers get them by default.
Infrastructure and secure development
- Least-privilege access across Supabase, Postgres, Fly.io and Vercel.
- Secret scanning, dependency scanning and static analysis in CI, with infrastructure defined as code.
- Logging, monitoring and an incident response plan that has been tested, not just written.
Compliance and trust
- Take Tano through SOC 2 Type I and into Type II, with evidence collected automatically through Oneleet.
- Own security reviews and questionnaires from brands, and the trust centre that answers most of them before they are asked.
- Run vendor reviews, access reviews, pentests and security training for the whole company.
Your first six months
- Ownership: a risk register and a security roadmap within your first month, and one clear line of escalation to the CTO.
- SOC 2: every control passing, the Type I report issued and the Type II observation window open.
- Time back for engineering: product engineers no longer collect evidence or fill in questionnaires.
- Posture: critical vulnerabilities triaged within a day and fixed within a week, a first pentest done and its findings fixed, and incident response tested.
- Secure by default: automated checks and secure infrastructure patterns in every repository, and clear limits on what each agent can do.
What we are looking for
- Five or more years in security engineering, ideally as the first or only security hire at a startup or scale-up.
- You have taken a company through SOC 2 or ISO 27001 and know which controls matter and which are paperwork.
- A hands-on engineer: you write the fix, the CI check and the infrastructure code, not only the ticket.
- You can explain a risk to a founder, a board or a brand's security team in plain English, and make a call when the answer isn't clear.
- A real interest in how AI agents fail, and how to stop them failing badly.
- Bonus: cloud and infrastructure security · Postgres and Supabase depth · LLM or agent security work · TypeScript or Go.
The stack
TypeScript (NestJS, Next.js) and Go, with Postgres, LangGraph, Google Gemini, Supabase, Fly.io and Vercel. Oneleet for compliance. Early enough that you will set the security patterns everyone else builds on.
The team you would join
Will Caplan, CEO
GTM lead at Encord (YC AI scale-up), and Sandhurst.
Sagar, CTO
Three years building AI agents, early before it was a category.
Nathan, Founding Engineer
Fastest-promoted engineer at a London YC scale-up.
Jake, Founding Engineer
Previously a founding engineer. Has grown a personal YouTube channel.
Eddie, Product Engineer
Previously did research at Stanford.
Process
- 01Intro call.
- 02Two 30-minute calls with Sagar and Will: motivation and technical depth.
- 03Onsite, mostly with Sagar: threat-model one of our agents together, plus time with the team and lunch.
Roughly two weeks end to end.
What is on offer
- Base
- Up to £150k, depending on experience
- Equity
- Share options
- Location
- Full-time, in person, central London
- Benefits
- Health insurance, onsite gym, in-person culture, real startup work-life