Job Opportunities API

SENIOR SECURITY ENGINEER LiteLLM is the world’s most popular AI Gateway, trusted by companies like Adobe, Netflix, and NASA. Our platform gives developers secure, reliable access to LLMs and adjacent services. We’re looking for our first Security Engineer to help secure LiteLLM’s application, infrastructure, and software-delivery pipeline. ABOUT THE ROLE This is a hands-on security generalist role with a strong emphasis on application security. You’ll spend most of your time reviewing and hardening LiteLLM’s Python codebase, identifying new attack surfaces, working directly with engineers to fix vulnerabilities, and making secure development practices part of how we build. You’ll also own security work across IT, CI/CD, cloud infrastructure, and the software supply chain. The ideal candidate has worked at an early-stage security startup during its 0→1 journey and genuinely enjoys security outside of work—through CTFs, vulnerability research, open-source projects, or independent experimentation. RESPONSIBILITIES APPLICATION SECURITY - Conduct deep security reviews of LiteLLM’s Python proxy, APIs, authentication systems, and enterprise features. - Identify and remediate vulnerabilities involving authentication, authorization, secrets, tenant isolation, injection, and data exposure. - Partner directly with engineers throughout design, implementation, code review, and release—not only after code is shipped. - Build application-security tooling into the development lifecycle, including SAST, DAST, dependency scanning, and secrets detection. - Perform internal red teaming and adversarial testing against LiteLLM’s APIs, proxy, and LLM-specific attack surfaces. - Threat-model new products and architecture changes before they reach production. - Create secure coding guidelines and train engineers on common vulnerabilities and defensive practices. INFRASTRUCTURE, CI/CD, AND SUPPLY-CHAIN SECURITY - Harden LiteLLM’s Docker images, PyPI packages, GitHub Actions workflows, and release infrastructure. - Detect dependency confusion, poisoned packages, compromised dependencies, exposed secrets, and unsafe build practices. - Implement SBOMs, signed builds, provenance checks, and reproducible-build practices. - Design secure-by-default configurations for cloud and self-hosted deployments, including authentication, IAM, secrets management, and key rotation. - Review cloud infrastructure, network boundaries, access controls, and production deployment patterns. IT SECURITY AND INCIDENT RESPONSE - Strengthen employee identity, device, SaaS, and internal access controls. - Build monitoring and anomaly detection for suspicious API, model, authentication, and routing activity. - Lead security incident response, vulnerability assessment, remediation, post-mortems, and stakeholder communication. - Establish formal vulnerability intake, CVE triage, disclosure, and remediation processes. - Maintain threat models as LiteLLM’s product and architecture evolve. WHAT WE’RE LOOKING FOR - A strong security generalist who can work across application security, IT, CI/CD, cloud infrastructure, and the software supply chain. - Deep application-security expertise, including manually auditing production Python code and working with engineers to remediate vulnerabilities. - Strong understanding of authentication, authorization, tenant isolation, SSRF, injection, deserialization, secrets management, and common web and API vulnerabilities. - Experience using and configuring tools such as Semgrep, Bandit, CodeQL, Burp Suite, and other SAST or DAST tooling. - Previous experience at an early-stage security startup during its 0→1 journey. - Experience securing containers, GitHub Actions, build pipelines, packages, and software dependencies. - Familiarity with SBOMs, Sigstore, Cosign, Snyk, Grype, Trivy, or equivalent tooling. - Strong knowledge of OAuth2, JWT, mTLS, IAM, and high-th