gem
Product Security Engineer
BackOps AI
San Francisco, USA
Full-time
Senior · 5+ years experience
Hybrid
Discovered 2 weeks ago
PythonGoTypeScriptOAuthOIDCRBAC
Free
Job Fit Check
Base Career helps you apply smarter for this job.
?%
Ready to ScanKey skills for this role
PythonGoTypeScript
Key Skills for This Role
PythonGoTypeScriptOAuthOIDCRBAC
Full Job Posting
- Own product security end to end: authentication, authorization, multi-tenant isolation, APIs, and the data model behind them.
- Threat model the agent platform. Define what an agent is allowed to do in a customer's systems, prove the boundary holds, and design what happens when an agent is asked to do something it should not.
- Build the secure development lifecycle: design review, code review standards, and scanning in CI with a triage path engineers actually use.
- Run application vulnerability management end to end. Find it, prioritize it by real exploitability rather than by scanner severity, get it fixed, verify the fix.
- Set the security bar for AI-assisted code. A large share of our code is written with coding agents, and human ownership of what merges is not optional.
- Secure the software supply chain: dependencies, build pipeline, artifacts, and third-party integrations.
- Own the engineering side of enterprise security reviews, penetration tests, and coordinated vulnerability disclosure, so customer scrutiny stops being a fire drill.
- Extend the same controls to customer-hosted and on-prem deployments, where they have to hold up without our infrastructure around them.
- 5+ years in product or application security engineering, or a software engineer who moved into security and stayed hands-on.
- Strong coding skills in Python, Go, TypeScript, or similar. You review real code and write the fix yourself.
- Real depth in authentication, authorization, and multi-tenant isolation: OAuth and OIDC, RBAC, token and session handling, and the access-control bugs that only show up between two features.
- Web and API security depth across the OWASP Top 10 classes: injection, SSRF, deserialization, and broken access control, and how these actually get exploited rather than how they are listed.
- Working familiarity with the OWASP Top 10 for Agentic Applications and the OWASP Top 10 for LLM Applications. Excessive agency and prompt injection are live concerns in our product today.
- Threat modeling that produces engineering work with owners and dates, not a document.
- Hands-on with SAST, DAST, SCA, and secrets scanning in CI, including keeping the noise low enough that teams do not turn the checks off.
- Judgment about risk. You can say what to fix now, what to accept, and why, to an audience that will push back.
Apply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career
More from this employer
More jobs at BackOps AI
Enterprise Account Executive
San Francisco, USA
Discovered 1 weeks agoFull-time
Senior Software Engineer
San Francisco, USA
Discovered 1 weeks agoFull-time
Enterprise Account Executive
Los Angeles, USA
Discovered 1 weeks agoFull-time
Enterprise Account Executive
New York City, USA
Discovered 1 weeks agoFull-time
Enterprise Account Executive
Chicago, USA
Discovered 1 weeks agoFull-time
Engineering Manager, Core Product Engineering
San Francisco, USA
Discovered 2 weeks agoFull-time
Engineering Manager, Infrastructure and Security
San Francisco, USA
Discovered 2 weeks agoFull-time
Technical Program Manager
San Francisco, USA
Discovered 2 weeks agoFull-time