Security Engineer

About the Role

We are looking for a hands-on Senior Product Security Engineer to secure enterprise applications and AI-powered products across multiple engineering teams and repositories.

In this role, you will identify and validate real-world vulnerabilities through manual security testing, source-code analysis, threat modeling, and AI red teaming. You will work directly with engineering teams to prioritize risks, drive remediation, and verify fixes across fast-moving development environments.

You will also help strengthen the security of AI-powered applications and agents by identifying emerging risks such as prompt injection, sensitive-data leakage, insecure tool execution, and authorization bypasses.

This is an opportunity for a security engineer who enjoys solving complex technical problems, going beyond automated scanners, and building practical security controls that scale across products.

• Perform hands-on security assessments across enterprise applications, APIs, AI-powered products, and multiple code repositories.

• Discover, exploit, validate, and document vulnerabilities through manual testing, source-code review, and security tools.

• Assess web applications and APIs for authentication and authorization weaknesses, business logic flaws, injection vulnerabilities, and other OWASP Top 10 risks.

• Test AI/LLM applications and agents for direct and indirect prompt injection, sensitive-data exposure, insecure tool execution, excessive permissions, and access-control bypasses.

• Conduct threat modeling, architecture reviews, and attack-path analysis to identify security gaps before they reach production.

• Assess cloud environments, IAM policies, containers, Kubernetes workloads, and CI/CD pipelines for security weaknesses.

• Prioritize vulnerabilities based on exploitability, business impact, exposure, and potential consequences—not just scanner severity scores.

• Partner with engineering teams to explain findings, recommend practical fixes, resolve remediation blockers, and verify fixes through retesting.

• Integrate security controls into the software development lifecycle using SAST, DAST, SCA, secrets detection, and automated security gates.

• Develop repeatable security testing approaches, automation, and remediation practices that scale across products and engineering teams.

• Communicate technical findings, business risks, and remediation priorities clearly to technical and non-technical stakeholders.

• 2 years of relevant experience in Application Security, Product Security, Application Security Engineering, or Offensive Security.

• Strong hands-on experience in web application and API security testing, including manually discovering, exploiting, and validating vulnerabilities.

• Solid understanding of the OWASP Top 10, authentication and authorization flaws, IDOR/BOLA, business logic vulnerabilities, and common web/API attack paths.

• Practical experience using Burp Suite Professional or OWASP ZAP for security testing.

• Experience with source-code security reviews, root-cause analysis, threat modeling, and remediation validation.

• Hands-on exposure to AI/LLM application security testing, including prompt injection, data leakage, or insecure AI agent/tool execution.

• Familiarity with cloud security, IAM, containers, Kubernetes, and CI/CD security practices.

• Experience working with application security tools such as SAST, DAST, SCA, and secrets detection.

• Ability to assess security risks independently, distinguish exploitable vulnerabilities from low-impact findings, and recommend actionable remediation.

• Demonstrated ownership of security findings from discovery and validation through remediation, retesting, and closure.

• Strong analytical, problem-solving, collaboration, and communication skills.