Staff Security Engineer, Cloud

We’re ALSO, an electric mobility company originally conceived as a part of Rivian. We’re a passionate team of builders, dreamers, doers and innovators, focused on creating entirely new (not to mention, innovative and delightful) vertically integrated, small EVs designed to meet the global mobility challenges of today and tomorrow. Our mission is to inspire everyone to ride ALSO—replacing many local car, truck and SUV miles with ones on vehicles that are more affordable, more enjoyable and 10-50x more efficient.

At ALSO, we are looking for a Staff Security Engineer for Cloud who wants to own security end to end — not advise on it, build it — for a connected, software-defined EV platform where nearly everything of value runs through the cloud: telemetry streaming in from vehicles in the field, remote diagnostics and updates, fleet intelligence, and the product APIs customers touch every day.

You'd set the security architecture and then build it yourself, in Go, alongside the backend team — equally comfortable writing a threat model, reviewing a Kubernetes admission policy, and shipping the service that enforces it. You'd be the person the company turns to for every question that starts with "is this secure," with the autonomy to actually answer it properly rather than just flag the risk and move on.

Own cloud security end to end — strategy, architecture, implementation, and operations across AWS, Kubernetes, and our microservices platform — including threat modeling new systems in architecture reviews before the code exists

Design and implement identity and access at scale: workload identity, org-wide IAM, least privilege by default, secrets management, and certificate/key lifecycle, including mutual TLS between services and between cloud and vehicle

Harden containers and orchestration: image provenance, admission control, runtime and network policy, service mesh configuration, and clean isolation across microservices

Secure the software supply chain: SBOM generation, dependency and image scanning, signed artifacts, and CI/CD pipelines that fail closed on what matters and stay quiet on what doesn't