Platform & Security Lead

We build custom software and AI solutions for our customers, and we run them once they're in production. Customers trust that what we've built is up, is secure and behaves the way we promised.

We're now looking for someone to take ownership of that whole picture. You'll own the operation of everything we have in production, make sure Nuto and our customers are secured against attacks, and make sure our processes and documentation live up to what we've committed to in our operations agreements.

You'll also have room to experiment. We always want to test the latest on the AI frontier, including open models running on local hardware.

What you'll be doing

• Own operations end to end: hosting, monitoring, incident handling, updates and capacity for every solution we run.
• Secure Nuto and our customers' solutions against attacks, with access control, secrets management, vulnerability scanning, logging and an incident response plan that has actually been rehearsed.
• Experiment with hardware and open models, and assess when local or self-hosted inference beats cloud services on cost, performance and privacy.
• Make sure our internal processes and documentation meet our operations agreements: SLAs, response times, backups, change routines and incident logs.
• Be the team's sparring partner on security and operations when we design and build new solutions.

We're looking for someone who

• Has experience running solutions in production, ideally on platforms such as Vercel, Supabase, Azure, AWS or GCP.
• Has a solid practical understanding of security, ideally with knowledge of frameworks such as ISO 27001, the Norwegian NSM basic principles for ICT security and GDPR.
• Is curious about hardware and open models, and has ideally run models locally themselves.
• Writes clear documentation and likes things to be in order.
• Takes ownership and stays calm when something breaks: finds the cause, fixes it and makes sure it doesn't happen again.
• Communicates well with both developers and customers, and can explain risk in a way that makes decisions easy.

Practical

• Full-time, based in the Oslo area.
• Reports to the CTO.
• Start date: by agreement.