Cybersecurity Engineer

SemiAnalysis is hiring its first dedicated Cybersecurity Engineer to own security across SemiAnalysis and Citrini. The role builds and operates offensive security, access controls, product protection, detection and response, and disaster recovery programs, while advising leadership on risk.

Responsibilities:

• Run a continuous offensive program against SemiAnalysis and Citrini: build an automated, LLM-driven red team (uncensored or open-weight models, agentic tooling) that probes our web properties, paywall, APIs, email, cloud accounts and staff around the clock, and triage what it surfaces
• Harden identity and access: enforce phishing-resistant MFA (hardware keys) for every account that matters, least-privilege admin on Google Workspace, Slack, GitHub, Stripe, SubStack and cloud, and kill shared credentials
• Protect the product: secure the paywall and subscriber data, detect credential sharing and scraping of paid content, watermark or fingerprint distributed reports, and monitor for leaked reports on Telegram, Discord, forums and dark-web markets
• Defend against insider and departure risk: DLP and egress controls on models, datasets and code; device management; a clean offboarding playbook; evidence preservation that stands up in trade-secret litigation
• Own people security: targeted phishing and vishing simulations against staff and founders, executive impersonation controls (deepfake voice, fake wires, fake interview requests), and short practical training
• Secure the engineering surface: GitHub org settings, secrets scanning, dependency and CI hygiene, cloud configuration review across our research and InferenceX work
• Build detection and response: centralise logs from SaaS and cloud, write alerts, run incident response, and own vendor relationships (MDR, pentest, forensics, cyber insurance)
• Own disaster recovery and business continuity: define recovery objectives for our publications, datasets, subscriber systems and code; put tested, offline-capable backups in place for every critical system; write and run recovery playbooks for ransomware, account takeover and SaaS or cloud outages; and run at least one restore and tabletop exercise a year
• Report to leadership quarterly on risk, with a prioritised roadmap and a budget

Requirements:

• 2+ years in security with real defensive or offensive experience: red team, blue team, penetration testing, bug bounty or adversary simulation, with findings you can walk us through
• Hands-on with LLM tooling for security: you have built or run agentic attack or recon pipelines, understand prompt injection and model abuse, and can run open-weight models yourself
• Strong on identity and SaaS security: Google Workspace, Okta or similar, Slack, GitHub, Stripe, cloud IAM (AWS or GCP)
• Practical backup and recovery experience: you have restored systems after an incident or outage, not just configured the backups
• Comfortable being the whole function: you can scope, build, operate and explain, and you know when to bring in outside help
• Can read and write code (Python at minimum) well enough to automate your own work and review ours
• Clear writer. Our business is written analysis; your incident reports and roadmaps will be read by the founders directly
• Experience defending a media, newsletter, data vendor or investment research business: paywall abuse, content leakage, scraping
• Insider-threat or DLP work, or involvement in trade-secret or IP litigation evidence
• Threat intelligence on financially motivated groups (ShinyHunters, Scattered Spider, Silent Ransom Group) and dark-web monitoring
• OSCP, OSEP, GIAC offensive certs, or a track record on HackerOne or Bugcrowd
• Familiarity with the semiconductor and AI infrastructure world, or with quant and hedge fund security expectations
• Experience with hardware or GPU-cluster environments, since some of our work touches lab and inference hardware