Security Engineer
for section headings (e.g., About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)
2. Use - for any list of duties/requirements/benefits, and
for prose
3. Do NOT repeat the job title as a heading (the page already shows it)
4. Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it
5. Preserve ALL substantive information; do NOT invent or summarize away detail
6. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions
7. Include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text
8. Never create Pay/Schedule/Benefits sections unless the posting actually states them
9. Prefer a few substantive sections over many thin ones
10. Output ONLY the HTML fragment — no /, no markdown code fences
Let me analyze the job posting content:
1. "About Qualitate" - company description
2. "The Role" - role description
3. "Who This Role Is For" - requirements/qualifications
4. "What Sets You Apart" - preferred qualifications
5. "Compensation & Benefits" - pay, equity, benefits, location/schedule
6. "What To Expect Working At Qualitate" - culture/values
I need to structure this into appropriate sections. The rules say to use specific heading names like "About the role", "Responsibilities", "Requirements", "Qualifications", "Skills", "Benefits", "Pay", "Schedule". But I should only include sections that have real content.
Looking at the content:
- "About Qualitate" could be "About the company" or similar, but the rules mention "About the role" as a heading. The posting has "The Role" section which describes the role.
- "Who This Role Is For" contains requirements - this maps to "Requirements" or "Qualifications"
- "What Sets You Apart" contains preferred qualifications - could be "Preferred qualifications" or part of "Qualifications"
- "Compensation & Benefits" has pay, equity, benefits, location/schedule - this maps to "Pay", "Benefits", "Schedule"
- "What To Expect Working At Qualitate" is culture/values - could be "Culture" or similar, but not in the suggested headings list. Might fold into benefits or keep as separate section.
The rules say: "use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)". So I should use these standard headings where appropriate.
Let me map:
- "The Role" -> "About the role" (or "Responsibilities"? The Role section describes what the person will do, so could be Responsibilities)
- "Who This Role Is For" -> "Requirements" (since it lists required experience/skills)
- "What Sets You Apart" -> "Qualifications" or "Preferred qualifications" (but "Qualifications" is in the example list)
- "Compensation & Benefits" -> split into "Pay", "Benefits", "Schedule"
- "What To Expect Working At Qualitate" -> maybe "Culture" but not in list. Could be "Benefits" but that's more about perks. Might create a "Culture" section or fold into "About the role". The rules say prefer few substantive sections over many thin ones. This section has substantive content about work environment.
Also there's "About Qualitate" at the beginning - company background. Could be "About the company" but not in example headings. Might include as a prologue paragraph before sections, or as "About the role" context.
The rules: "Do NOT repeat the job title as a heading (the page already shows it)". The job title isn't explicitly stated but implied "Security Engineer". The posting starts with "About Qualitate". I should not add a heading for the job title.
I'll structure as:
1. About the role (combining "The Role" description)
2. Responsibilities (from "The Role" - but The Role is more description than list of duties. It says "You'll harden our cloud environment, build logging, monitoring, and detection, remediate findings from penetration tests, and serve as the security reviewer on design docs... lead ISO 27001...". That's responsibilities. I'll make a Responsibilities section with bullet points.)
3. Requirements (from "Who This Role Is For")
4. Qualifications (from "What Sets You Apart" - preferred qualifications)
5. Pay (from Compensation & Benefits)
6. Benefits (from Compensation & Benefits)
7. Schedule (from Compensation & Benefits - location/schedule)
8. Culture (from "What To Expect Working At Qualitate") - but not in example headings. However, the rules say "e.g." so not exhaustive. I'll include it as it's substantive.
But the rules say: "include a section ONLY when the posting has real, specific content for it". All these have real content.
Also need to remove EEO boilerplate: "Qualitate is an equal opportunity employer. We encourage candidates of all backgrounds to apply." That's boilerplate, remove.
Also remove any application instructions (none present).
Now, I need to preserve ALL substantive information. So I must include all details from each section.
Let me draft HTML.
First, "About Qualitate" - company description. I'll include as a
before sections, or as part of "About the role". The rules say "About the role" is a heading example. I'll create an "About the role" section that includes company context and role overview.
But the posting has "About Qualitate" separate from "The Role". I'll keep "About Qualitate" as a short intro paragraph, then "About the role" heading for the role description.
Actually, the rules: "use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)". So "About the role" is a heading. I'll use that for the role description.
I'll structure:
About the role
Company description...
Role description...
But the company description is long. Might keep as separate paragraph before heading? The rules say output only HTML fragment, no /. I can start with a for company background, then headings.
Better: include company background in "About the role" section as prose.
Let's parse content:
"About Qualitate Qualitate is building the AI-native primary intelligence platform for enterprises, investment firms, and asset managers. We automate the entire primary research workflow, from study design and expert recruitment through AI-moderated interviews and insight synthesis – replacing weeks of manual research with hours of high-signal output. Expert research is a broken industry dominated by legacy incumbents with expensive, manual, and slow services. Investment and corporate strategy teams spend hundreds of hours coordinating intermediaries, scheduling expert calls, and synthesizing insights across fragmented providers. The process takes weeks to produce short-lived intelligence. Qualitate transforms this workflow by autonomously conducting expert discussions at scale using AI. Qualitate’s AI Moderator interviews thousands of experts simultaneously each month, capturing forward-looking purchasing plans, competitive displacement, and real-time ROI signals. The platform turns these interviews into quantified, time-series outputs tracking over 10,000 public and private companies, queryable instantly in natural language. Our customers include some of the world’s largest enterprises, hedge funds, PE firms, credit investors, and venture capital firms."
"The Role Join Qualitate as our first dedicated security engineer. At 45 people, the security program you build is the one the company will scale on. You’ll harden our cloud environment, build logging, monitoring, and detection, remediate findings from penetration tests, and serve as the security reviewer on design docs for new features and architecture changes. You’ll also lead ISO 27001 from start to finish: scoping, risk assessment, implementing controls, and getting us through the certification audit, with evidence collection automated instead of tracked in spreadsheets. This is a high-ownership role. You’ll be a part of our founding engineering team to define our security architecture and roadmap, and you’ll write and ship production code, not just review it. Our customers are hedge funds, PE firms, and large enterprises with demanding security requirements, so the systems you secure and the certifications you earn directly shape how fast we grow. The problems are specific to our platform: protecting confidential expert interviews and customer research, securing an AI system that runs thousands of interviews a month, and reaching ISO 27001 without slowing engineering down. You’ll report to our CTO, lead our response when something goes wrong, and partner with our VP of Compliance and Legal on policy, customer security reviews, and our broader compliance program. We’re looking for someone with 4+ years of security engineering experience, including hands-on compliance work, who thrives in fast-moving environments where the surface area is wide and the team is lean."
"Who This Role Is For 4+ years of experience in security engineering. Ideally some of it at a startup or high-growth SaaS company where you secured cloud infrastructure hands-on and also helped build a compliance program. Strong Cloud and infrastructure security skills. Experience securing AWS or GCP environments, including IAM, network security, logging and monitoring, secrets management, and encryption. You can read and write infrastructure-as-code. Penetration testing rigor. You can contribute to a production code base and address issues raised in a penetration test. ISO 27001 experience. You’ve helped take a company through ISO 27001 certification, including scoping the ISMS, running risk assessments, writing the Statement of Applicability, implementing controls, and managing the audit. SOC 2 Type II experience is a plus. [You’ve built the technical controls behind an ISO 27001 or SOC 2 Type II certification, such as access management, logging, vulnerability management, and encryption, and automated evidence collection rather than tracking it in spreadsheets. Familiarity with ISMS scoping, risk assessments, or the Statement of Applicability is a plus.] Fluent with AI models and agentic coding tools. You use AI in your daily workflow, understand the security and data governance risks of building with LLMs, and know how to defend against risks like prompt injection and data leakage. This is core to how we work. High ownership, low ego. You work independently, communicate proactively, and don’t wait to be told what to build. You’re comfortable making architecture decisions and defending them in code review."
"What Sets You Apart Hands-on experience with security tooling such as SIEM, EDR, CSPM, and vulnerability or container image scanning, and with compliance automation platforms like Vanta or Drata. Bonus if you’ve built reusable guardrails or libraries that make the secure path the easy path for other engineers. Experience securing LLM-based applications and agentic systems, including red-teaming AI features for prompt injection, data exfiltration, and tool misuse. Experience building technical controls for data segregation and access, ideally in financial services or expert networks where MNPI and client confidentiality matter. Security certifications such as ISO 27001 Lead Implementer or Lead Auditor, CCSP, AWS Security Specialty, or OSCP. Background in financial services and/or market research."
"Compensation & Benefits Base salary: $160-220K base salary, based on experience. Equity: Meaningful early-stage grant with upside tied to company growth. Benefits: Health coverage, flexible PTO, paid holidays. Location: Full-time, in-person in New York City Mon-Weds, remote Thurs-Fri."
"What To Expect Working At Qualitate Excellence. You’ll be held accountable to an exceptionally high bar for quality and impact. High velocity. Fast-p
for prose 3. Do NOT repeat the job title as a heading (the page already shows it) 4. Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it 5. Preserve ALL substantive information; do NOT invent or summarize away detail 6. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions 7. Include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text 8. Never create Pay/Schedule/Benefits sections unless the posting actually states them 9. Prefer a few substantive sections over many thin ones 10. Output ONLY the HTML fragment — no /, no markdown code fences Let me analyze the job posting content: 1. "About Qualitate" - company description 2. "The Role" - role description 3. "Who This Role Is For" - requirements/qualifications 4. "What Sets You Apart" - preferred qualifications 5. "Compensation & Benefits" - pay, equity, benefits, location/schedule 6. "What To Expect Working At Qualitate" - culture/values I need to structure this into appropriate sections. The rules say to use specific heading names like "About the role", "Responsibilities", "Requirements", "Qualifications", "Skills", "Benefits", "Pay", "Schedule". But I should only include sections that have real content. Looking at the content: - "About Qualitate" could be "About the company" or similar, but the rules mention "About the role" as a heading. The posting has "The Role" section which describes the role. - "Who This Role Is For" contains requirements - this maps to "Requirements" or "Qualifications" - "What Sets You Apart" contains preferred qualifications - could be "Preferred qualifications" or part of "Qualifications" - "Compensation & Benefits" has pay, equity, benefits, location/schedule - this maps to "Pay", "Benefits", "Schedule" - "What To Expect Working At Qualitate" is culture/values - could be "Culture" or similar, but not in the suggested headings list. Might fold into benefits or keep as separate section. The rules say: "use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)". So I should use these standard headings where appropriate. Let me map: - "The Role" -> "About the role" (or "Responsibilities"? The Role section describes what the person will do, so could be Responsibilities) - "Who This Role Is For" -> "Requirements" (since it lists required experience/skills) - "What Sets You Apart" -> "Qualifications" or "Preferred qualifications" (but "Qualifications" is in the example list) - "Compensation & Benefits" -> split into "Pay", "Benefits", "Schedule" - "What To Expect Working At Qualitate" -> maybe "Culture" but not in list. Could be "Benefits" but that's more about perks. Might create a "Culture" section or fold into "About the role". The rules say prefer few substantive sections over many thin ones. This section has substantive content about work environment. Also there's "About Qualitate" at the beginning - company background. Could be "About the company" but not in example headings. Might include as a prologue paragraph before sections, or as "About the role" context. The rules: "Do NOT repeat the job title as a heading (the page already shows it)". The job title isn't explicitly stated but implied "Security Engineer". The posting starts with "About Qualitate". I should not add a heading for the job title. I'll structure as: 1. About the role (combining "The Role" description) 2. Responsibilities (from "The Role" - but The Role is more description than list of duties. It says "You'll harden our cloud environment, build logging, monitoring, and detection, remediate findings from penetration tests, and serve as the security reviewer on design docs... lead ISO 27001...". That's responsibilities. I'll make a Responsibilities section with bullet points.) 3. Requirements (from "Who This Role Is For") 4. Qualifications (from "What Sets You Apart" - preferred qualifications) 5. Pay (from Compensation & Benefits) 6. Benefits (from Compensation & Benefits) 7. Schedule (from Compensation & Benefits - location/schedule) 8. Culture (from "What To Expect Working At Qualitate") - but not in example headings. However, the rules say "e.g." so not exhaustive. I'll include it as it's substantive. But the rules say: "include a section ONLY when the posting has real, specific content for it". All these have real content. Also need to remove EEO boilerplate: "Qualitate is an equal opportunity employer. We encourage candidates of all backgrounds to apply." That's boilerplate, remove. Also remove any application instructions (none present). Now, I need to preserve ALL substantive information. So I must include all details from each section. Let me draft HTML. First, "About Qualitate" - company description. I'll include as a
before sections, or as part of "About the role". The rules say "About the role" is a heading example. I'll create an "About the role" section that includes company context and role overview. But the posting has "About Qualitate" separate from "The Role". I'll keep "About Qualitate" as a short intro paragraph, then "About the role" heading for the role description. Actually, the rules: "use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)". So "About the role" is a heading. I'll use that for the role description.
I'll structure:
About the role
Company description...
Role description...
But the company description is long. Might keep as separate paragraph before heading? The rules say output only HTML fragment, no /. I can start with afor company background, then headings. Better: include company background in "About the role" section as prose. Let's parse content: "About Qualitate Qualitate is building the AI-native primary intelligence platform for enterprises, investment firms, and asset managers. We automate the entire primary research workflow, from study design and expert recruitment through AI-moderated interviews and insight synthesis – replacing weeks of manual research with hours of high-signal output. Expert research is a broken industry dominated by legacy incumbents with expensive, manual, and slow services. Investment and corporate strategy teams spend hundreds of hours coordinating intermediaries, scheduling expert calls, and synthesizing insights across fragmented providers. The process takes weeks to produce short-lived intelligence. Qualitate transforms this workflow by autonomously conducting expert discussions at scale using AI. Qualitate’s AI Moderator interviews thousands of experts simultaneously each month, capturing forward-looking purchasing plans, competitive displacement, and real-time ROI signals. The platform turns these interviews into quantified, time-series outputs tracking over 10,000 public and private companies, queryable instantly in natural language. Our customers include some of the world’s largest enterprises, hedge funds, PE firms, credit investors, and venture capital firms." "The Role Join Qualitate as our first dedicated security engineer. At 45 people, the security program you build is the one the company will scale on. You’ll harden our cloud environment, build logging, monitoring, and detection, remediate findings from penetration tests, and serve as the security reviewer on design docs for new features and architecture changes. You’ll also lead ISO 27001 from start to finish: scoping, risk assessment, implementing controls, and getting us through the certification audit, with evidence collection automated instead of tracked in spreadsheets. This is a high-ownership role. You’ll be a part of our founding engineering team to define our security architecture and roadmap, and you’ll write and ship production code, not just review it. Our customers are hedge funds, PE firms, and large enterprises with demanding security requirements, so the systems you secure and the certifications you earn directly shape how fast we grow. The problems are specific to our platform: protecting confidential expert interviews and customer research, securing an AI system that runs thousands of interviews a month, and reaching ISO 27001 without slowing engineering down. You’ll report to our CTO, lead our response when something goes wrong, and partner with our VP of Compliance and Legal on policy, customer security reviews, and our broader compliance program. We’re looking for someone with 4+ years of security engineering experience, including hands-on compliance work, who thrives in fast-moving environments where the surface area is wide and the team is lean." "Who This Role Is For 4+ years of experience in security engineering. Ideally some of it at a startup or high-growth SaaS company where you secured cloud infrastructure hands-on and also helped build a compliance program. Strong Cloud and infrastructure security skills. Experience securing AWS or GCP environments, including IAM, network security, logging and monitoring, secrets management, and encryption. You can read and write infrastructure-as-code. Penetration testing rigor. You can contribute to a production code base and address issues raised in a penetration test. ISO 27001 experience. You’ve helped take a company through ISO 27001 certification, including scoping the ISMS, running risk assessments, writing the Statement of Applicability, implementing controls, and managing the audit. SOC 2 Type II experience is a plus. [You’ve built the technical controls behind an ISO 27001 or SOC 2 Type II certification, such as access management, logging, vulnerability management, and encryption, and automated evidence collection rather than tracking it in spreadsheets. Familiarity with ISMS scoping, risk assessments, or the Statement of Applicability is a plus.] Fluent with AI models and agentic coding tools. You use AI in your daily workflow, understand the security and data governance risks of building with LLMs, and know how to defend against risks like prompt injection and data leakage. This is core to how we work. High ownership, low ego. You work independently, communicate proactively, and don’t wait to be told what to build. You’re comfortable making architecture decisions and defending them in code review." "What Sets You Apart Hands-on experience with security tooling such as SIEM, EDR, CSPM, and vulnerability or container image scanning, and with compliance automation platforms like Vanta or Drata. Bonus if you’ve built reusable guardrails or libraries that make the secure path the easy path for other engineers. Experience securing LLM-based applications and agentic systems, including red-teaming AI features for prompt injection, data exfiltration, and tool misuse. Experience building technical controls for data segregation and access, ideally in financial services or expert networks where MNPI and client confidentiality matter. Security certifications such as ISO 27001 Lead Implementer or Lead Auditor, CCSP, AWS Security Specialty, or OSCP. Background in financial services and/or market research." "Compensation & Benefits Base salary: $160-220K base salary, based on experience. Equity: Meaningful early-stage grant with upside tied to company growth. Benefits: Health coverage, flexible PTO, paid holidays. Location: Full-time, in-person in New York City Mon-Weds, remote Thurs-Fri." "What To Expect Working At Qualitate Excellence. You’ll be held accountable to an exceptionally high bar for quality and impact. High velocity. Fast-p