Staff Product Security Engineer

Join Endor Labs as a Staff Product Security Engineer, where you'll play a crucial role in shaping the security strategy for our platform. You'll work closely with the Head of Security & IT, fix application issues, prevent insecure code from being merged, and influence the product roadmap. This is a unique opportunity to help shape the product we build for customers while utilizing our own platform for application security. Enjoy a vibrant culture, competitive benefits, remote work options, and flexible PTO.

Conference talks, publications, or open-source work in application security

Even if you don't meet every requirement above, we encourage you to apply. There's no one-size-fits-all here

About Endor Labs

• A track record of influencing a product or platform roadmap: you've turned internal security work into something other teams or customers adopt
• Deep threat modeling and secure architecture skills. You know a strong threat model is one of the biggest levers in AI-driven scanning efforts

Responsibilities

• Collaborate with the Head of Security & IT to set and execute the security strategy for the Endor Labs platform, focusing on supply chain security, code scanning, and runtime monitoring.
• Lead efforts to fix issues in the application, validate and prioritize findings, and build a platform around this for customers.
• Build out the internal apparatus around the AI SAST product to stop insecure code from being merged, ensuring confidence in the security of code contributions.
• A fix-it mindset: you investigate, find root causes, and drive remediation rather than just reporting
• A track record of building security tooling and automation that runs at scale across an engineering organization, and of measuring whether it works

Requirements

• 10+ years in application or product security, including staff- or principal-level technical leadership
• Demonstrated hands-on work applying LLMs and agents to security problems. You've built a harness, compared tools, or measured where they fail, and you have well-reasoned opinions on both halves of AI code security: how to find, validate and fix vulnerabilities in existing code, and how best to prevent insecure code from being merged
• The ability to set direction and influence senior engineering, product and customer stakeholders without formal authority
• Comfort building from scratch in an ambiguous, fast-moving environment, and setting priorities without an established playbook
• Experience securing build systems and CI/CD at scale, especially Bazel monorepos
• A background in security research, such as vulnerability research, program analysis, or static analysis tooling