Skip to content
Sysadmin Jobs

Security & Infrastructure Engineer

XBuild

Location
Hybrid (San Francisco, California)
Compensation
$210k - $300k/yr
Employment
Full-time
Level
Senior Level
Posted 4 days ago

About the role

XBuild is building an automated back office for contractors, serving over 1,000 companies. This role is the first dedicated security and infrastructure hire, responsible for building the security program, managing GCP infrastructure, and securing AI agents.

Skills

Security engineering Infrastructure engineering GCP Threat modeling Access control Vulnerability management Incident response AI security Compliance Infrastructure as code CI/CD GitHub Actions Firebase Firestore Identity and SSO SaaS

Benefits

  • Medical insurance
  • Dental insurance
  • Vision insurance
  • 401(k)

Perks

  • Equity
  • Hybrid Work

Full job details

About XBuild

XBuild is building the back office that runs itself for contractors. Headquarters connects every system a contractor runs into one record of the business, and Rex, our AI operator, runs the work on top of it: building estimates and supplements from photos and measurements, chasing unpaid invoices, following up on stale leads. More than 1,000 companies doing $25B+ a year in work run on XBuild, and we've raised $25M+ from a16z and N47.

The role

You'll be our first dedicated security and infrastructure hire, and you'll own both. Contractors trust us with their customers' homes, insurance claims, photos and financials, and enterprise customers will check that we deserve it. AI makes attackers faster and gives us new attack surface: an agent that reads untrusted documents and acts on customer data. We want someone who has built a security program from zero, still writes the infrastructure code themselves, and also makes our engineers faster.

What you'll own

  • Security: threat models, access control and tenant isolation, secrets, vulnerability and dependency management, detection and incident response. You'll write and test the incident plan.

  • AI security: guardrails for Rex and our other agents, covering prompt injection, tool permissions, data boundaries between companies, and red-teaming.

  • Compliance: run our assessments and certifications, answer enterprise security questionnaires, and join security reviews on large deals.

  • Infrastructure: our GCP footprint (Cloud Run, Cloud Deploy, IAM, networking), Firebase and Firestore, infrastructure as code, cost, reliability and on-call.

  • Developer experience: CI/CD on GitHub Actions, preview environments, local dev, test speed. Make the secure path the easy path for a fast-moving team.

  • Company IT: identity and SSO, device management, access reviews, vendor risk.

You might be a fit if you

  • Have been the first or an early security or infrastructure owner at a growing SaaS company, and took it through SOC 2 or similar.

  • Are deep in at least one major cloud, ideally GCP, and comfortable across the rest of the stack.

  • Have led a real incident from detection to postmortem.

  • Judge risk pragmatically: you know which 10 things matter this quarter and which 100 can wait.

  • Write code, and review application code for security flaws, not just infrastructure config.

  • Explain risk clearly to engineers, executives, customers and auditors.

Nice to have: securing LLM agents, Firebase security rules, multi-tenant B2B SaaS, insurance or financial data.

Details: San Francisco, in office 3 days a week · $210–300k + 0.20–0.50% equity, depending on level · Medical, dental and vision insurance · 401(k) · US only; we sponsor H-1B transfers

To apply: tell us about the worst security incident you've handled and what you changed afterwards.