Sr. Security Engineer II

Insurance touches people during some of the most challenging moments in their lives. Hi Marley is on a mission to transform how the P&C industry communicates, making those moments faster, easier, and more empathetic for carriers and the customers they serve. We build AI-powered software that keeps everyone in the claims conversation informed and connected. If you believe insurance can combine operational excellence and automation with a human touch, we'd love to meet you.

As we continue to grow, we're looking for a Senior Security Engineer II to secure the internal tools and platforms that power Hi Marley's business. This is a hands-on engineering role working side by side with our Technical and Operations teams as they design, build, and run the tools our teams rely on every day, including a growing set of LLM integrations, agents, and MCP connectors. Reporting to our Director of Security, you'll shape the security architecture of our corporate and cloud environment, build guardrails into our infrastructure, lead threat modeling and design reviews, turn findings into fixes, and make sure our controls produce evidence an auditor can verify. This role is for an experienced security engineer who thinks in systems, writes code, and wants to help us adopt AI securely. Teamwork and shared enthusiasm are a core part of our culture, which is why this role involves joining us in the Boston office for 3 days each week.

What You'll Do:

Security Architecture & Engineering

• Strengthen the security of Hi Marley's corporate environment: identity and access (SSO, MFA, conditional access, and privileged access), SaaS configuration and integrations, and the AWS accounts that host our business and AI tools.

• Design and maintain secure reference patterns and preventive and detective guardrails as code (Terraform, service control policies, AWS Config, conditional access, and SaaS posture policies), so teams can adopt new tools quickly without reinventing controls.

• Run vulnerability and misconfiguration management across endpoints, SaaS applications, and cloud workloads, prioritizing exploitability and exposure, and tune detections from AWS, identity, and endpoint tooling to cut noise.

• Lead threat modeling and security design reviews for new tools, integrations, automations, and data flows before they go live, driving mitigations into the design phase.

• Partner with IT and AI-Operations (AI-Ops) teams on identity lifecycle, least-privilege access, secrets management, and workload isolation across our corporate environment.

Emerging Technology Security

• Apply the same architecture and threat modeling disciplines to the LLM integrations, agent frameworks, MCP connectors, and data pipelines they build.

• Integrate security into the pipelines that build and deploy internal AI-enabled tools and automations: SAST, SCA, secret detection, and IaC scanning (GitHub Advanced Security or similar), tuned so builders trust the signal.

• Implement controls for agent isolation, credential and token scoping, and data-boundary enforcement in agentic workloads and AI-connected business tools.

• Support adversarial testing for AI-specific risks (e.g. prompt injection, data exfiltration, and tool-use abuse) and penetration tests of our AI systems, and drive remediation of what they find.

• Contribute to security reviews of new AI tools, integrations, and third-party model providers.

Trust, Compliance & Collaboration

• Design controls that produce audit evidence by default and supply the technical evidence and documentation behind our SOC 2 Type II examinations and ISO 42001 certification.

• Build security tooling and automation that removes manual work from access reviews, detection, evidence collection, and response.

• Translate technical decisions into clear, auditor-ready explanations of what we do, how it works, and why it is safe.

• Mentor engineers, IT staff, and the business teams building with AI on secure design through reviews, documentation, and hands-on guidance.

• Track and report security metrics that show whether the program is working.

What We're Looking For:

Required

• 5+ years in security engineering, cloud security, or infrastructure security, including leading threat modeling and design reviews, ideally at a SaaS company.

• Hands-on AWS and identity security experience: IAM, network design, encryption, logging, native security services, SSO, MFA, and conditional access.

• Experience building security controls and automation as code: Terraform or similar IaC, security tooling in CI/CD pipelines, and strong Python.

• Experience running vulnerability management and producing audit evidence for SOC 2, ISO 27001, or similar frameworks.

• Proven ability to lead threat modeling and security architecture reviews for cloud-native applications, SaaS integrations, and internal tooling.

• Ability to communicate technical risk clearly to engineers, product managers, and auditors.

• Interest in AI and how it changes the attack surface. You don't need to be an AI security specialist, but you should want to help us adopt AI securely and learn by doing.

Preferred

• Experience securing LLM-based systems, agentic frameworks, or MCP connectors, and an understanding of AI-specific attack surfaces such as prompt injection, tool-use exploitation, and data leakage.

• Familiarity with ISO/IEC 42001 or the NIST AI RMF.

• Experience with detection engineering, SIEM, or observability for cloud and SaaS environments.

• Working knowledge of OAuth 2.0, OIDC, and SAML, including delegated access and token scoping for integrations.
• Experience at a growth-stage B2B SaaS company in a regulated industry.

Compensation, Benefits & Perks:
At Hi Marley, we are committed to fair and transparent pay practices. The annual base salary for this role is expected to fall within the range of [$121,000-$200,000], depending on experience, skills, qualifications, and location. Offers are determined based on these factors as well as internal peer equity. It's most common for new hires to start near the midpoint of the range, allowing room for growth as employees develop in their role.

In addition to base pay, we offer a comprehensive total rewards package that supports both your wellbeing and professional growth, including:

• Equity grants for all employees

• A 4% matching 401(k) program

• Medical, dental, vision, disability, and life insurance coverage for employees working 30+ hours per week

• Monthly wellness stipend

• Paid parental leave

• A flexible vacation policy - we all work hard and take time when we need it

Who We Are:
At Hi Marley, our culture is built on three core values that every employee embodies:

• Max Courage - We encourage our team, our customers, and their customers to dream big, try new ideas, and maximize impact by measuring risk.
• Be Humble - We lead with appreciation and promote a culture of humility, compassion, and openness to learn from anyone, anywhere.
• Ubuntu ("I am because we are") - We believe true success is much bigger than any single individual or company. By aligning our individual aims behind a shared purpose, we can achieve our fullest potential, together.

Life at Hi Marley:

Life at Hi Marley is shaped by collaboration, learning, and genuine connection. We're proud to foster an environment where people can do their best work, feel supported, and grow alongside a team that celebrates both individuality and shared purpose.

• A fun, lively startup culture that embraces creativity and innovation
• Core values-based leadership that guides our decision-making and daily interactions
• A culture of engagement, diversity, inclusion, and belonging: everyone's voice matters
• Flexible, hybrid work environment that values balance and trust
• Ample opportunities to learn, take on new challenges, and make an impact in a fast-growing organization
• Meaningful work that directly supports our mission to help people and organizations communicate with empathy and clarity

Hi Marley is proud to be an equal employment opportunity employer. We celebrate diversity and do not discriminate based on gender, sexual orientation, gender identity, religion, race, veteran status, disability status, or any other characteristic protected by applicable law. We are committed to building an inclusive work environment representing a variety of backgrounds, perspectives, and skills, where all employees are encouraged to be their authentic selves.