Product Security Engineer, Senior

The role

You will secure and advance TraceLink's products and internal application development. You will act as a senior technical lead for major products, performing hands-on assessments, code reviews, and building security automation and tooling.

What you will do

• Serve as senior security SME for engineering by supporting secure architecture, security requirements, and design reviews
• Lead threat modeling including abuse and misuse cases for AI-enabled and agentic features
• Provide secure coding guidance for Java and JavaScript
• Perform manual and automated code review
• Triage and validate findings from SAST, SCA, DAST and secrets scanning
• Conduct hands-on security assessments and white-box testing of services, APIs, and multi-tenant boundaries
• Author secure design patterns, guidance, and reusable components
• Build and improve automation and guardrails in CI/CD pipelines
• Use AI and LLM tooling to scale security work
• Review LLM and agent-backed features for prompt injection, excessive agency and data leakage

Required qualifications

• 7+ years in application or product security or software engineering with substantial security ownership
• Hands-on experience applying threat modeling or other risk identification techniques
• Strong knowledge of application security testing tools across SAST, SCA, DAST, secrets, IaC
• Deep understanding of the OWASP Top 10 for web, APIs and AI/LLM
• Strong knowledge of secure coding practices in Java and/or JavaScript
• Experience remediating complex enterprise-level security issues end to end
• Working knowledge of cloud environments (ideally AWS and Azure) and CI/CD pipelines
• A working understanding of how LLM-based features and AI coding assistants change the risk picture
• Strong analytical and problem-solving skills
• Strong verbal and written communication skills

Nice to have

• Familiarity with AWS and Azure services
• Knowledge of microservices, event-driven architecture and multi-tenant SaaS isolation
• Experience with ASPM platforms and reachability-based vulnerability prioritization
• Experience securing or red teaming AI, ML, or agentic systems
• Penetration testing, CTF experience, a hacker's mindset
• Bachelor's degree or equivalent experience in Computer Science, Information Systems Security, or a related field

About the company

TraceLink is the world’s largest Agentic Business Network, enabling life sciences and healthcare companies to build and manage a scalable digital workforce of governed, no-code AI agents. Founded in 2009, it has 5 global offices and over 800 employees.