Senior Security Engineer

About Gelato

Gelato runs the world's largest network for on-demand production of customized products, from t-shirts and wall art to mugs, books and cards. We're an AI-first, cloud-native platform with zero physical assets:

• GelatoCreate connects e-commerce businesses to 250+ partners across 32 countries, reaching over 5 billion people in under 72 hours.
• GelatoConnect, our AI-driven print production OS, runs producers' operations end to end, covering procurement, workflow and logistics.
• Optimalprint, where Gelato began, is our consumer brand in 20+ markets, helping millions of customers create personalised cards, wall art and gifts, online and through its app.

Together they sit between thousands of merchants, our production partners and millions of customers. Every order carries someone's data, designs and brand.

AI at the Core

We are not just early adopters of AI - we're AI-native builders, and security is no exception.

• AI is how we work. Engineers use LLMs for code generation, testing and documentation, and autonomous agents drive platform resilience, observability, cost control and internal workflow automation. Our security team works the same way, with LLMs and agents handling alert triage, threat summaries, runbooks and response orchestration.
• AI is also what we protect. AI agents already run inside GelatoConnect and our core platform. They map product catalogues, validate file uploads, and even write and deploy integration code. Agents with that kind of reach raise new questions about tool permissions, prompt injection and data flows, and you'll make sure what they build is secure without slowing our teams down.

The Role

This isn't an analyst role where you watch dashboards and send findings back. Our engineers now ship many times more than they used to with AI, so reviewing their work by hand doesn't scale. You'll build the agents and automation that review alongside them, make sure the agents engineering builds are secure too, and act as the bridge between information security and engineering.

You'll join a small information security team, reporting to [our Head of Information Security], and work across application security, cloud and identity, and detection and response. You don't need to be an expert in all of it. If you're strong in a few of these areas and keen to grow into the rest, we'll help you get there.

What You'll Do

• Automate with AI: build and operate agents for code and change review, alert triage, finding validation, investigation summaries and routing to owners. You'll connect them safely to internal systems with least privilege, audit logs and human approval for risky actions. You'll measure them honestly (accuracy, false-positive rate, time saved, what a human had to correct) and retire the ones that don't earn their keep.
• Secure the SDLC: own SAST, SCA, secret, container and IaC scanning, tuned so engineers trust the signal. Threat-model new services and AI features early, including the agents engineering builds, and build paved-road defaults (libraries, templates, CI checks) so common vulnerability classes become hard to introduce.
• Secure Cloud and Identity: assess and audit cloud and container platform security, including least-privilege IAM, preventative guardrails, cluster hardening, runtime detection and the infrastructure as code behind it. Our Platform team owns implementation. You'll also manage identity provider roles, clients and access reviews, and keep authentication and authorisation consistent across services.
• Detect and Respond: monitor through our SIEM, scan our attack surface, and lead incidents end to end: containment, investigation, communication, and a blameless write-up whose fixes actually land. Write response playbooks that agents run for the routine steps and that escalate to a person, with the work already done, when judgement is needed. Hunt proactively, feed what you find back into detections and guardrails, and share an on-call rotation.
• Partner with Engineering: explain risk plainly to engineers, product and leadership, and give prioritised, concrete fixes rather than a list of findings. Make security decisions visible by writing down the reasoning, the trade-off, and what we chose not to do.

What We're Looking For

• 5+ years in security engineering, AppSec, cloud security or incident response
• An AI-native way of working: hands-on experience building with LLMs (agents, tool calling, RAG or MCP), knowing where they fail, and using AI tools every day. This is a hard requirement.
• Hands-on experience securing a major public cloud (AWS preferred, but Azure or GCP works too), Kubernetes and infrastructure as code, plus solid web, API, OAuth 2.0 / OIDC and IAM fundamentals
• Solid foundations in application security, the secure SDLC and incident response, with deep expertise in some of them
• Production-quality code in Python, Go or TypeScript, and a habit of automating over repeating
• The ability to earn engineers' trust with plain explanations, practical fixes and pragmatic trade-offs
• Fluent written and spoken English

Nice to Have

• Offensive security: pentesting, bug bounty, CTFs or published research
• AI red-teaming or OWASP Top 10 for LLM Applications
• Threat hunting, forensics or malware analysis
• Hands-on experience with SIEM and SOAR / workflow automation platforms
• Experience running an open-source identity provider, Kubernetes runtime security or policy-as-code
• OSCP, OSWE, GCIH or cloud security certifications (a plus, never a requirement)

What it's like to work at Gelato

We are a customer-obsessed team with the ambition to change the world by connecting technology to the printing industry and making it much more sustainable. Everyone who joins our team must feel genuinely intrigued and motivated by our mission. We expect a lot. We are a driven team with big goals, so we seek individuals who are genuinely passionate about their work and possess an entrepreneurial spirit. Our culture is unique and we live by our values, so it's worth learning more about our culture and how we work before presenting your application.

At Gelato, we pride ourselves on our global presence with 11 offices worldwide, fostering a dynamic and diverse work environment. Rooted in a culture that values collaboration, creativity, and camaraderie, we actively cultivate a company culture that thrives on shared experiences. We encourage team members to embrace this culture by working from our office spaces at least three days a week, allowing for meaningful connections and collective growth.

Lastly, we ask that you please upload your CV in English, regardless of which country you are applying from.

Candidate Information

As part of our commitment to a transparent recruitment process, please be aware that following acceptance of an offer of employment with Gelato, you will be asked to complete a background check conducted by a third-party provider.