Description
We are looking for a Product Security Engineer to build systems that triage and validate bug bounty and other externally reported security findings. You will build large language model (LLM) and agent-based tooling that validates findings, traces them to their root cause, and opens fixes for well-understood vulnerability classes.
Responsibilities:
- Build systems that take in externally reported vulnerabilities and assess validity, severity, and reproducibility at a volume manual triage cannot match
- Build LLM and agent-based analysis that validates business logic, authentication, and design-level findings
- Build systems that trace validated findings to their root cause and propose, and increasingly open, fixes for well-understood vulnerability classes
- Own the bug bounty program, including scope, policy, and researcher engagement
- Extend the tooling into security testing capabilities that customers can use on what they build and deploy
Requirements:
- 5+ years of software engineering or security engineering experience
- Production code experience in JavaScript/TypeScript on Node.js
- Hands-on experience with web frameworks such as Next.js or React
- Experience with LLM or agent-based tooling
- Experience reproducing and assessing externally reported vulnerabilities
Nice to have:
- Experience building security automation used across an engineering org
- Experience building systems that auto-generate or propose code fixes
- Experience testing or securing multi-tenant platforms
Compensation & Benefits:
- Competitive compensation package, including equity
- Inclusive Healthcare Package
- Flexible Time Off
- WFH budget for outfitting your space
- The San Francisco, CA base pay range for this role is $208,000.00 - $312,000.00