Open roles at aicente

The role

You will own security across a real, large surface: a Next.js platform with 426 API routes that handles payments, Firebase auth, and sensitive business data. You will threat-model new features, run appsec reviews, lock down auth and secrets, monitor for abuse, and lead incident response. We take "do not regress" seriously — this role keeps it that way.

What you’ll do

• Threat-model features and run application security reviews (authz, injection, SSRF, secrets)
• Harden authentication/authorization (Firebase tokens, API keys, rate limits)
• Own cloud + platform security: least privilege, secrets, dependency and container scanning
• Build monitoring/alerting for abuse and lead incident response
• Own the security review process — protect the payment + email send paths

The expertise & skills you bring

• 4+ years in application/product security or security engineering
• Deep on web appsec (OWASP), auth, and cloud (GCP/AWS) security
• Read and write code — TypeScript/Node a big plus
• Calm, methodical incident handler with clear writing

A day in the life

• 9:00 — Triage alerts + dependency/CVE scan results.
• 10:30 — Security review on a new feature PR; threat model.
• 13:00 — Harden an auth path; add rate limits + tests.
• 15:00 — Improve monitoring; write up an incident runbook.

The team

• “One codebase touches payments, email and identity — the security work here is real and high-leverage.” — Security, aicente

aicente’s onsite working model

aicente is remote-first. Most roles are fully remote across US time zones, with optional desk space at our Seacoast, New Hampshire and Massachusetts hubs and quarterly in-person offsites where the whole team ships and connects.

Certifications

None required. Relevant professional certifications are a plus, never a filter - we hire on skills and drive.