Privacy and Security Engineer

A handy new SDK tries to call an ad server from inside a lesson. Your check fails the build before a single family sees it.

Tatako is hiring its first Privacy and Security Engineer to turn children’s privacy from a promise into code. What we collect and keep, which vendors get near the product and how we handle an incident are yours to design and enforce.

About Tatako

Tatako makes short spoken English lessons for little ones. A lesson takes about five minutes, there is nothing to read, and a small round octopus keeps everyone company. He has eight arms, no socks, and usually loses count at seven.

Spanish stays the language of home, and Tatako adds a little English on top. An optional Spanish guide voice explains what to do and switches off anytime. Every lesson has three small steps: Hear it, say it. Touch it. Name it. In the last step the picture comes back without the word, and the child names it first.

The course has 369 first words and phrases, from “hello” and “mommy” to colors, animals and what the teacher says at preschool. Tatako works in the browser on any phone or tablet, and we start with Spanish-speaking families across the United States.

The role

• Remote and full-time, open to candidates who live in Florida, Texas, Georgia, North Carolina, Tennessee or Arizona
• Fluent English
• You report directly to the founders

By day 90, a living data map shows where all family data sits, every SDK in the product has a written review, and a test proves deletion reaches every copy.

What you will do

• Make COPPA concrete: a data map of every field, from the Google sign-in to each of the grown-up’s marks, a deletion timeframe for each, and a security program tested every year.
• Keep data small and promises true: a privacy review in every feature spec, and the privacy policy, App Store privacy labels and Google Play Data safety form updated in the same pull request as the code.
• Build consent that holds up: clear notices for grown-ups, consent records with a date and a version, separate consent for any sharing a lesson does not need, and a parent’s consent on file for every child on camera.
• Prove deletion works: an automated test that deletes a test family and checks every database, vendor and device session, and a deletion log replayed after any restore so a backup never brings an account back.
• Vet every vendor and SDK: written assurances on children’s data, an allowlist for the lessons, a Content Security Policy that blocks the rest and a CI check that fails on any call to an ad or tracking domain.
• Run security reviews with the engineers: threat modeling for new features, Semgrep, Trufflehog and Checkov on every pull request, Nuclei on everything public, and AWS access reviewed with the SRE.
• Lead incident response: a written plan, a drill with the founders before launch, alerts that reach a person at any hour and notices to families drafted in advance.

What you bring

• 5+ years in security or privacy engineering at a consumer app or website, with code you shipped, not only reviews you wrote.
• Command of COPPA and its amended rule, US state privacy laws and the kids rules of both app stores, read as specs.
• Application security craft: custom static analysis rules, secure code review in Kotlin, Python and TypeScript, and OWASP MASVS in practice.
• Cloud and company security: IAM with EKS Pod Identity, KMS, GuardDuty and CloudTrail on AWS, Okta with SCIM, security keys for every login and access granted in Terraform.
• Privacy engineering habits: purpose limits written into schemas, consent tooling such as OneTrust, and Global Privacy Control honored on grown-up pages.
• Clear writing for two readers: a policy a parent understands and a review an engineer acts on.

Bonus points

• You hold a certification such as CIPT, CIPP/US or OSCP.
• You have taken an app through the App Store Kids Category or Google Play’s Families program.

Why you will love it

• You decide what never gets collected, and that choice is part of the product.
• The rules you write now ship with the apps, while every choice is still easy to make.

How to apply

Meet the octopus at tatako.com, then email [email protected] with your LinkedIn profile or portfolio. Make sure it shows privacy or security work you shipped in a real product.

Apply by email

If your experience matches the role, our team will get in touch to discuss next steps.