Product Security Engineer

Toronto; Boston; Calgary; California; Canada; Montreal; New York; Ottawa; Seattle; Vancouver

* Lead security reviews. Review architecture, code, and security-sensitive changes. Identify both individual vulnerabilities and the recurring design patterns behind them.

* Secure AI-powered products. Evaluate risks such as prompt injection, unsafe tool use, identity and delegation failures, excessive agency, data exposure, tenant isolation, and sandbox escapes.

* Threat model new capabilities. Identify trust boundaries, abuse cases, and high-impact failure modes before implementation. Translate findings into practical, prioritized mitigations.

* Perform hands-on testing. Investigate suspected vulnerabilities, develop proofs of concept, assess exploitability and impact, and partner with engineers through remediation.

* Build scalable guardrails. Develop secure defaults, approved patterns, reusable controls, review requirements, and automated checks that reduce recurring risks.

* Strengthen engineering capability. Pair with engineers, document practical guidance, and help product teams develop durable security expertise.

* Influence risk decisions. Explain technical findings, business impact, and remediation options clearly to engineers, product leaders, and executives.

* You have strong software engineering fundamentals and can independently understand, test, and contribute fixes to production codebases.

* You are proficient in at least one of Python, Go, or TypeScript.

* You have led security reviews or threat models for complex production systems and can point to meaningful design or risk improvements that resulted.

* You understand common vulnerability classes and their underlying design failures, including injection, authorization flaws, IDOR, SSRF, unsafe deserialization, race conditions, cryptographic misuse, and software supply-chain risks.

* You understand modern application architecture, including web applications, APIs, OAuth/OIDC, cloud platforms, containers, Kubernetes, and CI/CD systems.