Security Engineer, Product

The role

You will act as a hands-on offensive security practitioner to break products before adversaries do. You will conduct penetration testing, build security automation, and contribute to the codebase to harden the AI-driven platform.

What you will do

• Conduct hands-on penetration testing and red team assessments against applications, APIs, AI/ML pipelines, and cloud environments.
• Build agentic security tooling to find, validate, and patch vulnerabilities.
• Develop and maintain custom offensive tooling, exploit chains, and attack simulations.
• Build and operate automated security testing and remediation pipelines.
• Perform deep adversarial testing of AI-specific attack surfaces.
• Own vulnerability research and bug hunting to find logic flaws and chained exploits.
• Design and execute threat modeling sessions with engineering teams.
• Build attack simulation environments to validate security controls.
• Contribute directly to backend codebases and fix critical vulnerabilities.
• Lead purple team exercises to test detection and response capabilities.

Required qualifications

• Professional penetration testing experience across web apps, APIs, and cloud environments.
• Professional development experience in a strongly typed language (e.g., Rust, Go, Java, C++).
• Scripting languages (Python, Bash) for exploit development and tooling.
• Comfort with Burp Suite, Nuclei, Semgrep, and custom fuzzing frameworks.
• Experience integrating automated security checks into CI/CD pipelines (SCA, SAST, DAST).
• Comfort with infrastructure automation (Terraform, Kubernetes).
• Ability to identify misconfigurations and attack paths in AWS/GCP environments.
• Ability to communicate crisply and collaborate with developers, product teams, and leadership.
• Applied knowledge of threat modeling, cryptography fundamentals, and compliance frameworks (SOC 2, ISO 27001/42001, NIST CSF).

Nice to have

• OSCP, OSWE, GXPN, GWAPT, CPTS, or similar offensive security certifications.
• Experience testing multi-tenant SaaS platforms serving regulated industries.
• Financial services experience.
• Hands-on cloud penetration testing experience in AWS or GCP.
• Kubernetes security testing.
• Bug bounty track record or published CVEs / security research.
• Experience in customer-facing security conversations, technical sessions, pen test debrief calls, and security architecture reviews.

About the company

Rogo aims to transform global finance by empowering professionals at investment banks, private equity funds, and investment firms with AI. The company is scaling quickly and defining a new category of enterprise AI.