TRELLIS BUILDS AND DEPLOYS SELF-IMPROVING AGENTS TO GET PATIENTS ACCESS TO LIFE-SAVING MEDICINE.

Our AI agents process billions of dollars worth of therapies annually with patients in all fifty states. We do this by automating document intake, prior authorizations, and appeals at scale to streamline operations and accelerate care. We classify medical referrals, understand chart notes, and automate contract and reimbursement search to provide patients with accurate coverage determinations and cost responsibility. Think of us as the infrastructure behind how patients get their medications.

Trellis is a spinout from Stanford AI Lab and is backed by leading investors including YC, General Catalyst, Telesoft Partners, and executives at Google and Salesforce.

THE ROLE

We're hiring our first Security Lead to own security at Trellis end to end. Our agents read and write to electronic health records, fill out insurance portals, and handle protected health information for some of the largest healthcare providers in the country. Customers trust us with that data, and you'll make sure that trust is earned without slowing down how fast we ship.

This is a hands-on role. You'll set the security strategy, build the controls yourself, test them like an attacker would, and be the person customers talk to when they want to know how we keep their data safe. You'll report to Jacky (Co-founder & CTO).

WHAT YOU'LL DO

Own security end to end: Set the roadmap across cloud, application, endpoint, and data security, and decide what matters most right now

Balance security with speed: Build guardrails and paved roads so engineers can ship quickly and safely, rather than adding gates that slow the team down

Run offensive security: Pen test our own agents, infrastructure, and Windows session fleet; run red-team exercises and fix what you find

Lock down the cloud and identity: Own AWS security posture, IAM, secrets management, least-privilege access, and trust boundaries between customers, agents, and internal systems

Manage vulnerabilities: Stand up scanning, triage, and patching across code, dependencies, containers, and hosts, with clear SLAs

Be the voice of security to customers: Answer security questionnaires, join diligence calls, and lead audits and certifications (SOC 2, HIPAA, HITRUST as needed)

Plan for incidents: Build logging, detection, and an incident response plan, and run the response when something happens

ABOUT YOU

You've been the person responsible for security, not just a contributor to it. You're as comfortable reviewing an IAM policy or writing an exploit as you are walking a hospital CISO through our architecture. You care about real risk more than checklists, and you know that a security program engineers route around is not a security program.

WHAT YOU'LL BRING

6+ years in security engineering, with time owning security at a startup or high-growth company

Deep experience with AWS security, IAM, and cloud infrastructure

Hands-on offensive security experience: penetration testing, red teaming, or bug bounty work

Experience running vulnerability management and incident response programs

Experience leading SOC 2 and/or HIPAA compliance efforts and answering customer security reviews

Comfort with Windows Server and Active Directory environments is a plus

Healthcare or other regulated-industry experience is a big plus

Clear communication with engineers, executives, and customers

High ownership and the ability to operate autonomously in a fast-moving startup

WHY WORK WITH US

Real impact at massive scale: We serve patients in all fifty states and are scaling to hundreds of healthcare locations. The systems you protect carry the health data of patients waiting on treatment.

Incredible growth and traction: We've grown revenue 10x in the past few months alone.

Work with the founding team: Partner directly with founders and F500 customers, alongside healthcare operations leaders who have overseen 50+ locations.

Be at the forefront of AI in healthcare: Work on production-grade agentic systems that make critical healthcare decisions, not a demo.