Senior Product Security Engineer

The role

You will own application security end to end, securing the Endor Labs application from code to runtime. You will also act as customer zero for the product to help shape the roadmap.

What you will do

• Own software supply chain security including open-source packages, third-party binaries, container base images, build tools, and software dependencies.
• Own first-party software security including code and container scanning, automated security testing in CI, and external penetration tests.
• Harden AI agents by enforcing least-privilege access across MCP, credentials, filesystem, and network resources.
• Own and run the responsible disclosure program and triage external reports.
• Partner with engineering teams to conduct security design reviews and define secure architectures.
• Help shape and evolve the application security program.
• Use the security platform firsthand to provide feedback and influence the product roadmap.

Required qualifications

• 5+ years of experience in application security or product security.
• At least 2 years of experience working with the security implications of agentic software development.
• Strong experience with threat modeling and secure architecture design.
• Practical experience securing build systems and CI/CD pipelines at scale.
• Hands-on experience running penetration tests end-to-end.
• Experience triaging bug bounty or responsible disclosure submissions.
• Ability to investigate, understand, and remediate security issues.
• Comfortable working in ambiguous, fast-moving environments.
• Attacker mindset with the ability to identify root causes.
• Strong collaboration and communication skills.

Nice to have

• Experience with Bazel monorepos

About the company

Endor Labs is a company securing AI coding through its AURI platform. The company was founded by Varun Badhwar and has raised $163M from investors including Lightspeed and Salesforce Ventures.