Product Security Engineer

What You’ll Do

1. Leads the red team: maintains the hypothesis backlog, runs the tests, reports which controls fired, and hands misses to the blue team.
2. Runs the AI-assisted penetration testing tooling: continuous, logged, and limited by a deterministic gate that controls what the agents may touch.
3. Sets the scope for the external penetration test and retests every finding before closure.
4. Holds the pull request gate: every AI-generated change goes through human review with security checks enforced in CI/CD.
5. Runs the fix-feedback loop: every security fix is re-attacked and behavior-tested before release. A green test suite alone does not ship a fix.
6. Owns the curated component inventory and version policy the AI coding agents build from, so generated code uses current, approved libraries.
7. Triages vulnerabilities by reachability with the detection and response engineer: is the library present, is the method called, does user input reach it.
8. Secures the AI agents and MCP servers in the development pipeline: inventory, authority boundaries, gateways, interrupts, provenance review.
9. Owns the security automation harness the team's agents run on, documented from day one.
10. Works directly with engineering squads and DevOps on findings, fixes, and change management.

Requirements

1. Offensive security engineering: writes a hypothesis, runs it, documents whether the control fired. Reproduces findings as working exploits and turns them into regression tests.
2. Software engineering: ships code into CI/CD (Azure DevOps or equivalent), reads pull requests line by line, builds pipeline checks.
3. Cloud design: AWS, containers, serverless, IAM. Understands where a change can reach.
4. AI-native operation: runs several AI agents at once with deterministic gates and logged actions; commands and audits rather than operating one task at a time.
5. Judgment: states an agent's authority boundary and blast radius in writing before building it.
6. Five or more years in security engineering, application security, or offensive security, with production code shipped.

Useful

1. SBOM/SCA and reachability tooling, MCP protocol internals, Orca, Sumo Logic, PCI DSS and SOC 2, MITRE ATT&CK or AADAPT technique mapping.

This position may require occasional after-hours work and participation in an on-call rotation to support business needs.

Benefits

1. They deliver laptop, almost all new.
2. 10 paid vacation days.
3. For each year of seniority 1 day of vacation is added.
4. Holidays are those of ARG, some are moved to coincide with those of USA.
5. Training paid courses.
6. Wise/Payoneer means of payment or wherever you want.