This role can be based in Stockholm or New York. It is a 5-day in-office role, we believe building together in person drives better outcomes.

What you will be doing:

• Own security work end to end: architecture, tooling, roadmap, and outcomes.
• Work embedded with engineering teams to make secure design, development, and operations the default.
• Build and ship software: guardrails, detections, libraries, automation, and workflows that live in git, are reviewed, tested, and deployed through CI/CD.
• Raise the security bar across engineering through design reviews, threat modelling, tooling, and enablement.
• Fix the class of bug, not just the instance, by turning findings into patterns, defaults, or detections.
• Secure a multi-tenant AI platform, including identity, authorisation, tenant isolation, data handling, and model-facing attack surfaces.
• Build with LLMs and agents, and help secure code and workflows produced at agent speed.
• Respond to incidents and write post-mortems that lead to meaningful technical and organisational improvements.

Your specialisation:

• Application Security: Threat model features and architectures, review high-risk changes across authentication, authorisation, tenant isolation, and data handling, and secure AI and agentic product features against prompt injection, tool-use abuse, data exfiltration, and related attack paths.
• Detection Engineering & Response: Own detection-as-code, security data pipelines, abuse and account-compromise detection, and incident response across corporate and product surfaces. Build the agents that run first-pass triage and investigation, plus the guardrails and evals that make their output trustworthy. No tiered queue.
• Cloud & Platform Security: Harden identity, access, cloud control planes, CI/CD, supply chain, infrastructure-as-code, AKS baselines, tenant isolation primitives, and least-privilege access for engineers, workloads, and AI agents.

Who you are:

• Several years of engineering experience in your security specialisation, with real depth in vulnerabilities you have found, incidents you have run, systems you have hardened, or tooling you have built.
• You are an engineer who writes production-quality code; we work primarily in TypeScript/Node.js and Python.
• You are comfortable operating across application security, detection and response, and cloud/platform security, even if one of those areas is your main depth.
• You understand identity, authorisation, multi-tenancy, and where security boundaries tend to break.
• You communicate clearly, translate risk into engineering terms, and influence teams without relying on mandates.
• You are calm and structured under incident pressure, and honest afterwards.
• You are excited by a small team with a large surface area, where the right answer is usually to build leverage rather than create queues.

Nice to have:

• Experience securing LLM-based or agentic products.
• Experience building a security function at a high-growth SaaS company.
• Familiarity with multi-tenant SaaS isolation models.
• Experience in environments with strict confidentiality, data residency, or professional secrecy requirements.
• Supply chain security depth, such as SLSA, artifact signing, or SBOMs.

If you are close but not a perfect match on the list, apply anyway and tell us what you would own.

Legora is an Equal Opportunity Employer

At Legora, we believe great teams are built on diversity of thought and experience. We’re proud to be an equal opportunity employer and committed to creating an inclusive, high-performance culture where everyone can do their best work. We welcome people of all backgrounds and don’t discriminate based on race, color, religion, national origin, gender, gender identity or expression, sexual orientation, age, disability, veteran status, or any other characteristic protected by law.