RemoteLeaf Logo
Log in Sign up

Senior Security Engineer, Product Security

9 hours, 57 minutes ago
United States
Full-time
Senior
Security Engineer
Cybersecurity
AWS CI/CD Encryption GraphQL .NET Node.js OAuth OpenAPI Penetration Testing Python REST API Secrets Management TypeScript
Apply Now
GoodLeap

GoodLeap

GoodLeap is a leading fintech for sustainable home solutions, offering a one-stop point of sale solution for eco-friendly upgrades with flexible payment options to make sustainable living more accessible and affordable.

Capital Markets
1K-5K
Founded 2003
View All Jobs 6

Description

  • Adversarially test LLM-backed applications and agents for prompt injection, jailbreaks, tool abuse, and data exfiltration.
  • Build and operate production security services and internal tooling using appropriate backend technologies.
  • Automate repetitive security processes and evaluate opportunities to replace or improve existing tools.
  • Triage vulnerability findings from scanning and AI-assisted reviews, investigate high-risk changes, and recommend fixes.
  • Threat model product requirements and technical designs by identifying trust boundaries, data flows, and security risks.
  • Perform manual testing of web applications and APIs, validate exploitability, and retest remediations.
  • Maintain AppSec tooling, including SAST and dependency scanning, finding routing, SSO, and access management.
  • Secure supporting infrastructure through least-privilege IAM, secrets management, container and network controls, and infrastructure as code.
  • Develop practical security training and documentation for engineering teams.
  • Evaluate security products, define launch standards for AI systems, and support investigations, threat hunting, incident response, and vulnerability management.

Requirements

  • Production backend engineering experience in at least one of TypeScript, Node.js, .NET, or Python, including async patterns, HTTP APIs, and streaming transports.
  • Ability to read and assess code across multiple languages and stacks and distinguish genuine vulnerabilities from false positives.
  • Strong understanding of identity and authorization risks, including token exchange, scopes, sessions, request signing, OAuth, SSRF, and DNS rebinding.
  • Experience securing REST and GraphQL APIs, OpenAPI and schema contracts, input validation, rate limiting, gateway authentication, and webhook or service-to-service verification.
  • Hands-on manual testing of web applications and APIs, including vulnerability triage, reporting, and remediation retesting.
  • Experience threat modeling from product requirements and technical designs.
  • Working knowledge of AWS and infrastructure as code, including IAM, secrets, containers, compute, and network egress controls.
  • Practical experience attacking an LLM-backed application or agent through work, research, CTFs, or a personal lab.
  • Ability to communicate security findings and recommendations to engineers, product managers, executives, and Legal.
  • Preferred: AppSec tooling ownership, vendor evaluations, security policy development, AI security standards, security training, cryptography, incident response, threat hunting, or SaaS product development experience.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

True Zero Technologies

Zero Trust Engineer (R-00205)

True Zero Technologies 11-50 Internet Software & Services

True Zero Technologies is seeking Zero Trust Engineers to implement enterprise Zero Trust use cases across prioritized Department of Veterans Affairs information systems and guide them through planning, validation, testing, and operational transition.

Anywhere Full-time Senior Security Engineer
Azure Cybersecurity
8 hours, 57 minutes ago
True Zero Technologies

Pillar Lead: Device & Endpoint Specialist (R-00212)

True Zero Technologies 11-50 Internet Software & Services

True Zero Technologies is seeking a Device & Endpoint Specialist to lead the Devices pillar of enterprise Zero Trust architecture, supporting implementation and integrating device posture and security signals into access decisions.

Anywhere Full-time Senior Security Engineer
CrowdStrike Cybersecurity
9 hours, 12 minutes ago
Included Health

Senior Security Operations Engineer

Included Health 1K-5K Insurance

Included Health is seeking a remote Senior Security Operations Engineer to lead DLP protection across corporate and cloud environments, investigating data security events and improving defenses against data loss.

United States Full-time Senior Security Engineer
$128k-$235k
CrowdStrike Network Security PowerShell Python SIEM Splunk SQL
9 hours, 27 minutes ago
True Zero Technologies

Pillar Lead: Indentity Architect (R-00210)

True Zero Technologies 11-50 Internet Software & Services

True Zero Technologies is seeking an Identity Architect to lead the Identity pillar for VA Zero Trust initiatives by defining reusable identity architecture, access models, and integration patterns across enterprise systems.

Anywhere Full-time Lead Security Engineer
Active Directory
9 hours, 27 minutes ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers