5+ years in application security, product security, security engineering, or software engineering with a security focus.
Bachelor's degree in computer science or related field; advanced degrees in cryptography are a plus.
Deep understanding of web application security fundamentals and protocols.
Experience with AI in engineering, including building applications or agents with AI SDKs.
Proven ability to develop security software, not just deploy existing tools.
Hands-on experience in identifying and mitigating vulnerabilities through design and code reviews.
Familiarity with modern software development practices.
Responsibilities
Design and operate security workflows that review code changes and propose fixes.
Build evaluations and feedback loops to assess vulnerabilities and proposed fixes.
Lead security and design reviews, collaborating with developers to identify vulnerabilities.
Secure the firm's use of agentic AI, focusing on identity and data access.
Partner with development teams to enhance secure coding practices and the Secure Development Lifecycle (SDLC).
Represent Information Security to engineering teams, translating findings into actionable guidance.
Benefits
Medical and prescription drug coverage.
401(k) contribution matching.
Wellness reimbursement.
Family building benefits.
Charitable gift match program.
Full Job Description
What you'll do day-to-day
Design, build, and operate agentic security workflows that continuously review code changes, using existing analyzers and custom analysis to investigate findings and propose fixes.
Build evaluations, feedback loops, and guardrails that assess false positives, missed vulnerabilities, and the safety of proposed fixes, using known test cases and expert review.
Lead security and design reviews for new and existing software, working directly with developers to identify vulnerabilities and recommend practical remediation.
Help secure the firm's own use of agentic AI, assessing how developer agents and internal AI platforms handle identity, data access, and tool execution.
Partner with development teams to embed secure coding practices and strengthen the Secure Development Lifecycle (SDLC).
Represent Information Security to engineering teams, turning findings into clear, actionable guidance for technical and, occasionally, non-technical stakeholders.
What we're looking for
At least five years of experience in application security, product security, security engineering, or software engineering with a solid security focus.
A bachelor's degree or higher in computer science or a related technical discipline; advanced degrees in relevant specialties, such as cryptography, are welcome.
Advanced knowledge of web application security fundamentals, including web protocols, authentication and identity standards (e.g., OIDC), browser security behavior, and applied encryption basics.
Fluency using AI in day-to-day engineering work; experience building applications or agents with AI SDKs, or an understanding of security risks in agentic applications.
A track record of building security software, such as product features, internal tools, custom scanners, or analysis capabilities, rather than only deploying or operating off-the-shelf tools.
Hands-on experience finding and mitigating vulnerabilities in complex systems through secure design review, code review, or penetration testing.
Familiarity with modern software development practices and workflows.
Sound judgment and clear communication, with the ability to work effectively with developers and make security decisions independently.
The expected annual base salary for this position is $225,000 to $300,000. Our compensation and benefits package includes variable compensation in the form of a year-end bonus, guaranteed in the first year of hire, and benefits including medical and prescription drug coverage, 401(k) contribution matching, wellness reimbursement, family building benefits, and a charitable gift match program.
