Senior Security Engineer

About Blue: Blue is building a new kind of phone, with your chief of staff built in. Blue sees what you do and reads every notification, text, and email for you. Based on everything it’s learned about you, it decides what to do with each one: handle it and leave you an FYI, or draft a reply and wait for your OK. Anything in your life is one ask away from being off your plate. Blue can manage complex long term tasks across apps

Delegation this deep isn’t possible from a single agent in an app. It takes owning the operating system, the whole intelligence stack, and, ultimately, the hardware. Today the Blue OS runs on Google Pixel hardware while our own hardware is in development. We’re Y Combinator-backed, seed-funded, going into our series A, and our first customers already use it as their daily phone.

It works from day one. When you switch, Blue reads everything that comes over from your iPhone, so it already knows the people in your life, how you write, and the passwords, cards, and IDs it needs, kept in a secure vault you both share. No onboarding, and no explaining yourself.

The role

You will have one job: making sure Blue is secure in every way, and that no change from anyone, teammate or AI agent, puts that at risk. Blue reads every notification, text and email, holds people's passwords, cards and IDs, and acts on their behalf, so the stakes are unusually high. You will have the authority to block any change that weakens security, and you will also own identity, login and accounts.

What you'll own

• Security across every boundary: The OS and its privileged services, our apps, the servers, the vault, and the assistant itself, including prompt injection from web pages, messages and connected services
• Data security: Least-privilege access to production, secrets management, and the systems that hold customers' passwords and personal data
• Identity and accounts: Login, account recovery, sessions and device trust
• Process: Threat models for new features, a security bar every engineer knows, dependency and secrets hygiene, and how we handle reported vulnerabilities
• Review: Required review on every change to the vault, authentication, permissions, or the assistant's access to other apps' data
• Mentoring: Helping early-career engineers learn to spot security problems themselves

What we're looking for

• You have secured a product used by real people end to end, not just one layer of it
• You understand the security risks of LLM agents, especially prompt injection and over-broad permissions
• You can explain a risk clearly enough that people change their plans, and you are comfortable saying no
• You give real reviews and have mentored junior engineers
• You work well with ambiguity and can move quickly without sacrificing quality
• You want to make a Blue Phone your daily phone

Nice to have

• Hardened OS work, verified boot
• Strong Android or mobile security: the permission model, app sandboxing, SELinux, keystore and credential handling
• Password managers, authentication or identity systems
• Cloud security on AWS
• Experience reviewing AI-generated code, or working with coding agents

Why join now

• You will be the most senior engineer in your domain on a small team, hired to set the security bar for the whole company
• People trust Blue with everything; you will make sure that trust is earned