应用安全负责人
Application Security Lead
关于Hightouch
Hightouch是一个由行业领先的可组合CDP驱动的智能营销平台。通过在一个地方整合完整的品牌背景、客户数据和绩效历史，每位营销人员都能自行构建和部署端到端的营销活动。团队可以更快地推进工作，保持品牌一致性，并获得真正有效的AI营销方案。
Hightouch成立于2019年，总部位于旧金山，帮助营销团队以前所未有的速度和质量分析绩效、头脑风暴并生成创意。
被列为2026年Gartner® Magic Quadrant™客户数据平台领域的领导者，Hightouch受到Domino's、Spotify、Aritzia、Cars.com、Ramp和PetSmart等领先企业的信赖。
在Hightouch，我们的使命是帮助客户利用数据和AI推动业务增长。团队充满雄心、注重成果、高效运作——我们相信谦逊、善良和同理心是成功的关键。如果你热衷于高速度、执着于提升标准，并希望与那些彼此关心、也关心客户的伙伴一起打造产品，我们期待与你见面。
职位介绍
这是我们首次专门招聘安全岗位，这是一个难得的机会，可以从零开始定义这个职能。你将全面负责Hightouch的应用安全态势。我们有扎实的工程基础和稳固的架构；现在你将塑造安全在这里的样子，随着团队从70名工程师扩展到140+人。
这是一个亲自动手、高度自主的职位。你大部分时间会花在代码库中，而不是会议中。你将解决安全与分布式系统交汇处的难题：
- 在每天运行约100万次数据同步、每秒处理10万+事件的系统中实现多租户隔离
- 子租户访问控制——针对多团队和多品牌使用场景，需要对配置和数据进行差异化访问控制
- 安全架构——构建和优化计算隔离框架，进行威胁建模和新产品的加固
- 面向互联网的API——我们高吞吐量的面向互联网的架构服务客户数据。你将改进我们的速率限制、滥用检测和访问控制的粒度
- 多区域和多云——支持我们的多区域和多云后端，包括扩展至新区域以满足全球客户的数据本地化需求
你将主导自己的发展路线。我们正在…
查看英文原文
About Hightouch
Hightouch is an Agentic Marketing Platform powered by the industry-leading Composable CDP. With complete brand context, customer data, and performance history in one place, every marketer finally has the power to build and ship end-to-end campaigns themselves. Teams move faster, stay on brand, and get AI marketing that actually works.
Founded in 2019 and headquartered in San Francisco, Hightouch enables marketing teams to analyze performance, brainstorm ideas, and generate creative at a speed and quality that wasn't previously possible.
Named a Leader in the 2026 Gartner® Magic Quadrant™ for Customer Data Platforms, Hightouch is trusted by leading enterprises like Domino's, Spotify, Aritzia, Cars.com, Ramp, and PetSmart.
At Hightouch, our mission is to help our customers leverage data and AI to grow their businesses. The team is ambitious, impact-driven, efficient — and we believe humility, kindness, and compassion are essential to our success. If you're energized by velocity, obsessed with raising the bar, and want to build alongside people who care deeply about each other and our customers, we'd love to meet you.
About the Role
This is our first dedicated security hire, and it's a rare chance to define the function from the ground up. You'll own Hightouch's application security posture end-to-end. We have strong engineering fundamentals and a solid foundation; now you'll shape what security looks like here as we scale from 70 to 140+ engineers.
This is a hands-on, high-autonomy role. You'll spend most of your time in the codebase, not in meetings. You’ll be solving hard problems at the intersection of security and distributed systems:
- Multi-tenant isolation on a system running ~1M data syncs per day and ingesting 100K+ events/sec
- Sub-tenant access control - for multi-team and multi-brand use cases, requiring differentiated access to configuration and data
- Security architecture - Build and refine our frameworks for compute isolation and perform threat modeling and hardening of new products
- Internet-facing APIs - Our high-throughput, internet-facing architecture services customer data at scale. You’ll improve our rate limiting, abuse detection, and granularity of access control
- Multi-Region and Multi-Cloud - Supporting our multi-region and multi-cloud backend, including extending it to launch Hightouch on in new regions to support data residency requirements of our global customer base
You'll own your roadmap. We're not looking for someone to run a checklist — we're looking for someone who can look at our architecture, identify the highest-leverage problems, and go fix them.
We are looking for talented, intellectually curious, and motivated individuals who are interested in tackling the problems above. This is a senior role, but we focus on impact and potential for growth more than years of experience. The salary range for this position is $180,000 - $400,000 USD per year, which is location independent in accordance with our remote-first policy. We also offer meaningful equity compensation in the form of ISO options, and offer early exercise and a 10 year post-termination exercise window.
About You
You’ve been an early security hire at a SaaS company before and moved the needle on how they approach security. You can read application code, threat model a distributed system, and ship production fixes. You have significant distributed systems expertise so that you can understand and influence what is being built by the product teams and influence from a place of trust.
Experience that's relevant:
- Being an early security hire (first 1-3) at a SaaS or data infrastructure company
- Securing multi-tenant platforms: tenant isolation, authorization models, etc
- Cloud security on systems that span more than one cloud and operate against customer-owned accounts
- Design and build of data infrastructure as an early engineer, not just a user. You helped secure it from early design or during major redesigns. You understand how it scales and how it’s secured
- Privacy-adjacent security (PII handling, data residency, GDPR/CCPA technical controls)
We don't care about certifications. We care about what you've built.
Interview Process
- Recruiter Screen [30m] - Introductory mutual fit assessment
- Security Architecture Interview [60m] - Threat model discussion of a real-ish system, followed by a systems design exercise
- Core interview [90m] - deep dive on distributed systems knowledge
- Hiring Manager Interview [60m] - What you've built in the past, how you work
- Security Program Interview [60m] with Head of Engineering — How you've run security programs in practice: bug bounty, pentest engagements, working with external researchers, and partnering across engineering to drive adoption.
E-Verify Statement
Hightouch participates in E-Verify. After you join the team, we'll verify your eligibility to work in the U.S. by submitting information from your Form I-9 to the Social Security Administration and, if needed, the Department of Homeland Security. This process happens post-hire only — we never use E-Verify to pre-screen applicants.
E-Verify Notice
E-Verify Notice (Spanish)
Right to Work Notice
Right to Work Notice (Spanish)