RemoteLeaf Logo
Log in Sign up

Senior Security Engineer, Product Security

1 month, 3 weeks ago
United States
Full-time
Senior
Security Engineer
Cybersecurity
AWS CI/CD Encryption GraphQL .NET Node.js OAuth OpenAPI Penetration Testing Python REST API Secrets Management TypeScript
Apply Now
GoodLeap

GoodLeap

GoodLeap is a leading fintech for sustainable home solutions, offering a one-stop point of sale solution for eco-friendly upgrades with flexible payment options to make sustainable living more accessible and affordable.

Capital Markets
1K-5K
Founded 2003
View All Jobs 3

Description

  • Adversarially test LLM-backed applications and agents for prompt injection, jailbreaks, tool abuse, and data exfiltration.
  • Build and operate production security services and internal tooling using appropriate backend technologies.
  • Automate repetitive security processes and evaluate opportunities to replace or improve existing tools.
  • Triage vulnerability findings from scanning and AI-assisted reviews, investigate high-risk changes, and recommend fixes.
  • Threat model product requirements and technical designs by identifying trust boundaries, data flows, and security risks.
  • Perform manual testing of web applications and APIs, validate exploitability, and retest remediations.
  • Maintain AppSec tooling, including SAST and dependency scanning, finding routing, SSO, and access management.
  • Secure supporting infrastructure through least-privilege IAM, secrets management, container and network controls, and infrastructure as code.
  • Develop practical security training and documentation for engineering teams.
  • Evaluate security products, define launch standards for AI systems, and support investigations, threat hunting, incident response, and vulnerability management.

Requirements

  • Production backend engineering experience in at least one of TypeScript, Node.js, .NET, or Python, including async patterns, HTTP APIs, and streaming transports.
  • Ability to read and assess code across multiple languages and stacks and distinguish genuine vulnerabilities from false positives.
  • Strong understanding of identity and authorization risks, including token exchange, scopes, sessions, request signing, OAuth, SSRF, and DNS rebinding.
  • Experience securing REST and GraphQL APIs, OpenAPI and schema contracts, input validation, rate limiting, gateway authentication, and webhook or service-to-service verification.
  • Hands-on manual testing of web applications and APIs, including vulnerability triage, reporting, and remediation retesting.
  • Experience threat modeling from product requirements and technical designs.
  • Working knowledge of AWS and infrastructure as code, including IAM, secrets, containers, compute, and network egress controls.
  • Practical experience attacking an LLM-backed application or agent through work, research, CTFs, or a personal lab.
  • Ability to communicate security findings and recommendations to engineers, product managers, executives, and Legal.
  • Preferred: AppSec tooling ownership, vendor evaluations, security policy development, AI security standards, security training, cryptography, incident response, threat hunting, or SaaS product development experience.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

Nooks

Cybersecurity Engineer

Nooks 1-10 Professional Services

Nooks is seeking a hands-on Cybersecurity Engineer to own and strengthen the company’s unclassified environment, maintaining NIST SP 800-171 and CMMC Level 2 compliance and audit readiness across its facilities.

United States Full-time Senior Security Engineer
$145k-$163k
Cybersecurity
1 day, 18 hours ago
Dijital Team

Senior Microsoft Engineer (Level 3) | Azure | M365 | Security

Dijital Team 11-50 Internet Software & Services

A Senior Microsoft Engineer (Level 3) will serve as a technical authority for a managed IT services provider, resolving complex issues and improving the security, reliability, and efficiency of multi-tenant Microsoft cloud environments for commercial customers.

Sri Lanka Full-time Senior Cloud Engineer Security Engineer
Azure Cybersecurity PowerShell
1 day, 18 hours ago
Jobandtalent

HQ - Lead Information Security Engineer

Jobandtalent 1K-5K Professional Services

Job&Talent is seeking a Lead Information Security Engineer to lead a team of four and strengthen incident response, threat detection, cloud security, and security operations for its global AI-powered workforce platform.

Spain Full-time Lead Security Engineer
AWS Azure CI/CD SIEM
1 day, 18 hours ago
ITHAKA

Platform Security Engineer

ITHAKA 251-1K Diversified Consumer Services

ITHAKA is seeking a Platform Security Engineer to mature its DevOps practices into DevSecOps by integrating security automation, tooling, and secure-by-default workflows across software delivery and infrastructure.

United States Full-time Mid Level Security Engineer
$110k-$120k
AWS CI/CD DevSecOps
2 days, 18 hours ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers