Product Security Engineer (North Security)

Join our team as a Senior Product Security Engineer, where you'll work closely with engineers to review architecture and code, conduct threat modeling, and perform hands-on testing. You'll also develop scalable security guardrails, strengthen engineering capability, and influence risk decisions. This is a hands-on engineering role, not an advisory one.

If any of the above doesn’t line up exactly with your experience, we still encourage you to apply

Responsibilities

• Lead security reviews, review architecture, code, and security-sensitive changes, and identify vulnerabilities.
• Secure AI-powered products by evaluating risks such as prompt injection, unsafe tool use, and data exposure.
• Perform hands-on testing, investigate suspected vulnerabilities, develop proofs of concept, and partner with engineers through remediation.
• You understand common vulnerability classes and their underlying design failures, including injection, authorization flaws, IDOR, SSRF, unsafe deserialization, race conditions, cryptographic misuse, and software supply-chain risks

Requirements

• You have driven security improvements involving multiple engineering teams, including situations where influence mattered more than authority
• You communicate clearly with both technical and non-technical audiences
• You can reason rigorously about untrusted input, authorization, isolation, identity, delegation, and data boundaries. Direct experience with agentic AI systems is valuable but not required
• You understand modern application architecture, including web applications, APIs, OAuth/OIDC, cloud platforms, containers, Kubernetes, and CI/CD systems
• You have led security reviews or threat models for complex production systems and can point to meaningful design or risk improvements that resulted
• You are proficient in at least one of Python, Go, or TypeScript
• You have strong software engineering fundamentals and can independently understand, test, and contribute fixes to production codebases
• Offensive security experience through penetration testing, red teaming or security research
• Experience building or operating security tooling such as SAST, DAST, SCA, custom linters, or policy-as-code
• Contributions to open-source security projects, published research, conference talks, or credited vulnerability discoveries
• Experience securing multi-tenant SaaS, enterprise software, or systems that process sensitive customer data

Preferred

• Experience operating or participating in a vulnerability disclosure or bug bounty program