Senior Product Security Engineer

Lambda, The Superintelligence Cloud, is a leader in AI cloud infrastructure serving tens of thousands of customers. Our customers range from AI researchers to enterprises and hyperscalers. Lambda's mission is to make compute as ubiquitous as electricity and give everyone the power of superintelligence. One person, one GPU.

Lambda Security protects some of the world's most valuable digital assets: training data, model weights representing immense computational investments, and the sensitive inputs required to leverage best-of-breed AI models. We're responsible for securing every byte that powers breakthrough artificial intelligence.

As a Senior Security Engineer on Product Security, you'll make sure the right security decisions get made in everything Lambda sells, from the network and cluster infrastructure in our data centers to the software our customers use every day. Reporting to the Senior Manager of Security, you'll join a team spanning infrastructure security and application security, owning security outcomes for your area and partnering closely with Product Engineering, Data Center Operations and Engineering, Detection & Response, and GRC.

Responsibilities

• Review Designs and Threat Model: Own security design reviews and threat models for the systems in your area, delivering actionable recommendations while changes are still cheap.
• Secure Multi-Tenant Infrastructure: Harden the network, cluster, and infrastructure-service layers that keep each customer's workloads isolated from every other customer's.
• Find and Fix Vulnerabilities in Code: Review application code and infrastructure as code, find vulnerabilities through analysis and testing, and land fixes with the owning team.
• Run Vulnerability Management as a Program: Turn scanner output into accurate, prioritized facts about real risk, and drive remediation to SLA alongside our Technical Program Managers.
• Develop Security Patterns and Requirements: Turn recurring review findings into requirements, reference patterns, and guardrails that the teams you support adopt by default.
• Enable Enterprise Deals: Partner with GRC on customer security reviews and architecture discussions, giving customers clear, technically grounded answers about how we protect their workloads.
• Build Security Tooling: Ship Python or Go automation, using Lambda-hosted LLMs, frontier models, and AI tools, that extends review and triage coverage.
• Partner Across Engineering: Work with Product Engineering, Data Center Operations and Engineering, and Detection & Response, including on bug bounty and vulnerability disclosure reports.
• Coach Engineers: Help engineers in the teams you support build secure design instincts, and mentor newer members of the security team.
• Balance Strategic and Tactical: Recognize when to invest in a long-term fix versus when "good enough" is exactly that, and bias toward measurable forward progress.

Requirements

• 5+ years of demonstrated security engineering experience, either directly as a security engineer or as a software, infrastructure, or site reliability engineer driving security outcomes.
• Demonstrated depth in infrastructure security or application security, with design reviews, threat models, or fixes that engineering teams actually adopted.
• A track record of independently owning security work end to end, making sound calls on your own and knowing when to escalate.
• Thrives in high-speed, high-ambiguity startup environments where priorities shift regularly and structure must be built while executing.
• Strong hands-on Linux experience in both bare metal and cloud environments, understanding infrastructure from kernel to application layer.
• Reads application code and infrastructure as code (e.g., Terraform, Ansible, Kubernetes manifests) fluently enough to explain a vulnerability's root cause, not just a scanner's verdict.
• Ships production-grade tooling in Python, Go, or a similar language, rather than only one-off scripts.
• Translates security risk into business impact for engineers, leadership, and customers, enabling them to make informed decisions.
• Excellent collaboration with technical teams both with and without authority.

Nice to Have

• Deep code analysis expertise, such as source code auditing, fuzzing, reverse engineering, or vulnerability research with published findings or CVEs.
• Experience securing multi-tenant infrastructure: network segmentation, virtualization or container isolation, Kubernetes, or hardware root of trust and secure boot.
• You've led the security assessment and requirements for a major platform component or enterprise system.
• Experience building infrastructure-as-code security guardrails, such as policy-as-code checks in CI/CD or secure-by-default modules.
• You've run vulnerability management as a program, with risk-based prioritization and remediation SLAs that held.
• Experience supporting enterprise customer security reviews, or providing significant evidence for compliance audits such as SOC 2, ISO 27001, or FedRAMP.
• Experience with AI/ML infrastructure security, model security, or protecting high-value computational workloads.
• Significant experience operating large-scale production services or with virtualization at scale.
• Enthusiasm about leveraging LLMs on Lambda's own infrastructure, frontier models, and AI tools to push product security beyond the status quo.

Benefits

• Generous cash & equity compensation
• Health, dental, and vision coverage for you and your dependents
• Wellness and commuter stipends for select roles
• 401k Plan with 2% company match (USA employees)
• Flexible paid time off plan