Senior Security Engineer

The role

This person will secure LiteLLM's application, infrastructure, and software-delivery pipeline. They will review and harden the Python codebase and own security work across IT, CI/CD, cloud infrastructure, and the software supply chain.

What you will do

• Conduct deep security reviews of LiteLLM's Python proxy, APIs, authentication systems, and enterprise features.
• Identify and remediate vulnerabilities involving authentication, authorization, secrets, tenant isolation, injection, and data exposure.
• Partner with engineers throughout design, implementation, code review, and release.
• Build application-security tooling into the development lifecycle.
• Perform internal red teaming and adversarial testing.
• Threat-model new products and architecture changes.
• Create secure coding guidelines and train engineers.
• Harden Docker images, PyPI packages, GitHub Actions workflows, and release infrastructure.
• Implement SBOMs, signed builds, provenance checks, and reproducible-build practices.
• Design secure-by-default configurations for cloud and self-hosted deployments.

Required qualifications

• Strong security generalist who can work across application security, IT, CI/CD, cloud infrastructure, and the software supply chain.
• Deep application-security expertise, including manually auditing production Python code and working with engineers to remediate vulnerabilities.
• Strong understanding of authentication, authorization, tenant isolation, SSRF, injection, deserialization, secrets management, and common web and API vulnerabilities.
• Experience using and configuring tools such as Semgrep, Bandit, CodeQL, Burp Suite, and other SAST or DAST tooling.
• Experience securing containers, GitHub Actions, build pipelines, packages, and software dependencies.
• Strong knowledge of OAuth2, JWT, mTLS, IAM, and high-throughput API authentication.
• Familiarity with prompt injection, LLM data exfiltration, tool abuse, and the OWASP Top 10 for LLM Applications.
• Experience with incident response, CVSS scoring, vulnerability management, CVE triage, and coordinated disclosure.
• Experience competing in CTFs during college or independently pursuing vulnerability research, reverse engineering, bug bounties, or security projects.
• A genuine interest in security outside your day job.
• Bachelor's or Master's degree in Computer Science or a related field, or equivalent practical experience.

Nice to have

• Previous experience at an early-stage security startup during its 0→1 journey.
• Familiarity with SBOMs, Sigstore, Cosign, Snyk, Grype, Trivy, or equivalent tooling.

Benefits

• Competitive salary
• Health benefits
• Dental benefits
• Vision benefits

About the company

LiteLLM is a Python SDK and Proxy Server that enables seamless access to more than 100 LLM APIs through the OpenAI format. Their platform gives developers secure, reliable access to LLMs and adjacent services.