Senior Security Engineer
Aleroy
Senior Security Engineer
Aleroy
Unified API for scalable AI inference
Aleroy is building a unified platform for high-performance AI inference, making it easier for companies to deploy and run AI models at scale.
Through a single API, Aleroy provides access to ready-to-use and custom AI models across cloud infrastructure, dedicated capacity, and customers' own hardware. Our platform optimizes performance, cost, and deployment flexibility while giving enterprises control over where and how their AI workloads run.
We work in small teams, collaborate directly, and focus on solving complex engineering challenges to build reliable, scalable AI infrastructure.
You are our first dedicated security engineer. Our engineering team builds and runs a multi-tenant cloud platform that also runs on infrastructure from partners. You review it, test it and challenge it, so that we, our customers and our auditors can trust it. The role is independent of the teams whose work you review, which is why it reports to the COO. You work closely with our CTO and engineers every day. We are preparing for ISO 27001 and SOC2, and you will help keep the technical side of that work honest after certification.
Threat modelling and design review. Security review of new features and architecture changes before they ship.
Security testing. Regular testing of our applications, APIs and cloud setup, and follow-up until findings are fixed.
Tenant isolation. Review of how customer data and workloads are kept apart, and proof that it holds.
Cloud and production access. Review of access, secrets and configuration across our cloud and production systems.
Partners and suppliers. Technical security due diligence on partners and suppliers whose infrastructure we use.
Data handling. Checking that data retention and deletion work as designed, with evidence.
Customer and audit assurance. Technical evidence for customer security reviews and for our ISO 27001 and SOC 2 audits.
A threat model of our core platform, agreed with engineering.
A first round of security testing, with a clear plan for the findings.
A simple, repeatable process for reviewing new partners before they go live.
6 to 10 years in security, with most of it in application security or cloud security.
Hands-on testing skills: code review, API and web application testing, cloud configuration review.
Deep experience with at least one major cloud provider, and with containers and Kubernetes or similar.
You have secured a multi-tenant SaaS or platform product.
You have implemented security controls that went through an ISO 27001 or SOC 2 audit, and you can show the evidence they produced.
You have worked in a startup or scale-up, ideally as the first or an early security hire.
You say clearly when something is not safe, explain the risk in business terms, and bring a practical fix.
You work well with engineers: you review and challenge their work and still keep their trust.
Clear written English. Your findings and reports can go straight to a customer or an auditor.
Security of AI and LLM systems.
Experience with key management, wallets or other crypto infrastructure.
Scripting and automation, including using AI tools in security work.
Experience working with customers in regulated or government sectors.
The chance to build the security function of a growing group from the start.
Direct work with the COO and CTO, and quick decisions.
A competitive package, discussed during the process.
24 days annual leave plus public holidays.
Health insurance.
Modern office in Yas Creative Hub.
Aleroy provides a single API for running AI models at scale, supporting both ready-to-use and custom models across cloud, dedicated capacity, and customer-owned hardware. It handles the entire inference lifecycle—optimization, deployment, and scaling—while letting enterprises choose where workloads run and ensuring data remains in their own infrastructure, with a zero-retention policy on prompts and outputs. The platform supports both dedicated and shared inference and differentiates itself with infrastructure-agnostic delivery via one API and options to monetize idle GPU capacity through white-labeled services or GPU-sharing partnerships. Its goal is to give enterprises precise control over AI deployments, optimize performance and cost, and enable secure, scalable inference across multiple environments.
Explore more opportunities at Aleroy