Product Security Engineer

About RocketlaneRocketlane is a B2B SaaS platform for client onboarding and project delivery, and we're building Nitro, our AI-native product layer. We're looking for a Product Security Engineer to own product and infrastructure security for the company.

What you'll own

This is a hands-on, individual-contributor security role covering the full range of product security work, not just one slice of it.

Offensive security and vulnerability discovery

• Run internal penetration tests across our web app, APIs, mobile app, and cloud infrastructure, and triage findings from external pentest vendors

• Actively hunt for vulnerabilities in new features, including in AI/LLM-powered surfaces (prompt injection paths, unsafe code execution in agent tooling, unauthenticated internal endpoints)

• Have found and driven the fix for real vulnerabilities before. We need someone who thinks like an attacker, not just someone who runs a scanner and files a ticket

Cloud and infrastructure security

• Review and harden our AWS setup: WAF rules, ALB/CloudFront TLS policies and cipher suites, container isolation, IAM and secrets hygiene

• Investigate and close out Dependabot and other CI/CD security alerts across dozens of repos, and work with engineering teams to get fixes prioritized and shipped

• Build and maintain internal security tooling

Compliance and customer trust

• Help with our compliance audit cycles end to end: evidence collection, control testing, and coordinating with auditors. This typically takes up 5% of the work.

• Respond to customer security questionnaires and InfoSec review requests, working with sales and customer success to turn these around quickly and accurately

• Keep our security documentation and posture current as the product and infrastructure evolve

Cross-team coordination

• Work directly with engineering, platform, and ops teams to get security fixes prioritized and shipped, not just logged

• Report critical findings up to leadership with clear, actionable writeups (source, sink, impact, fix)

What we're looking for

• 3+ years in a hands-on security role covering penetration testing and vulnerability research, ideally across web, API, mobile, and cloud

• Real, demonstrable experience finding and helping fix serious vulnerabilities (RCE, auth bypass, injection classes), not just running automated scans

• Solid working knowledge of AWS security: WAF, ALB/CloudFront, IAM, container security on ECS or similar

• Comfort integrating security tooling into CI/CD pipelines (SAST/DAST, dependency scanning) and driving remediation with engineering teams

• Experience with, or strong interest in, securing LLM/AI-powered applications: unsafe code execution, prompt injection, agent tool-call boundaries

• Strong written communication. You'll be writing up findings for engineers and explaining risk to non-technical stakeholders in the same week

Nice to have

• Experience building or maintaining internal security scanning tools

• Familiarity with Java/Spring Boot stacks (our backend) or Python (our AI/LLM stack)

• A CTF background, bug bounty track record, or security certifications (OSCP, etc.)

• Prior exposure to SOC 2 or similar compliance frameworks and customer-facing security questionnaires would be a plus

Why this role

You'd be the primary security engineer for a fast-moving product company actively shipping AI agent features, with direct access to leadership and real ownership over what gets fixed and when.