{"id":2394604,"url":"https://alion.io/job/backops-product-security-engineer","title":"Product Security Engineer","company":{"id":3801726,"name":"Backops","domain":"backops.com","url":"https://alion.io/company/backops-2","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Gem","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":144000,"max_usd":280000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1121},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Function Calling","optional":true},{"name":"ISO 27001","optional":true},{"name":"SOC 2","optional":true},{"name":"Tool Use","optional":true}],"status":"live","first_seen_at":"2026-09-01T00:01:39Z","employer_posted_date":"2026-09-01","last_verified_at":"2026-10-13T08:23:32Z","board_verified":true,"closed_at":null,"days_open":42,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":42},"description":"About BackOps\nBackOps AI transforms supply-chain operations with agentic AI that automates complex workflows, freeing teams to focus on what matters most. Headquartered in the San Francisco Bay Area, we foster a culture of innovation, ownership, and measurable impact.\nThe Role\nOur agents take real actions inside our customers' live operations. They read from and write to the systems a supply-chain team runs its business on. That makes authorization, tenant isolation, and the blast radius of a single agent action product design questions, and it puts product security on the critical path of every enterprise deal we close.\nWe are looking for the engineer who owns that. This is a hands-on role and the first dedicated product security hire, so you will build the product security practice and do the work at the same time.\nYou will work closely with engineering and infrastructure on how our systems get built and run, and with product on what gets built next. You will read the code, write the fix, and ship guardrails that engineers keep switched on because they are fast and mostly right.\nYour Impact\nIn this role, you will own the security of the BackOps product end to end, and set the bar for how secure software gets built here while the company triples in size.\nOwn product security end to end: authentication, authorization, multi-tenant isolation, APIs, and the data model behind them.\nThreat model the agent platform. Define what an agent is allowed to do in a customer's systems, prove the boundary holds, and design what happens when an agent is asked to do something it should not.\nBuild the secure development lifecycle: design review, code review standards, and scanning in CI with a triage path engineers actually use.\nRun application vulnerability management end to end. Find it, prioritize it by real exploitability rather than by scanner severity, get it fixed, verify the fix.\nSet the security bar for AI-assisted code. A large share of our code is written with coding agents, and human ownership of what merges is not optional.\nSecure the software supply chain: dependencies, build pipeline, artifacts, and third-party integrations.\nOwn the engineering side of enterprise security reviews, penetration tests, and coordinated vulnerability disclosure, so customer scrutiny stops being a fire drill.\nExtend the same controls to customer-hosted and on-prem deployments, where they have to hold up without our infrastructure around them.\nWhat We're Looking For\n5+ years in product or application security engineering, or a software engineer who moved into security and stayed hands-on.\nStrong coding skills in Python, Go, TypeScript, or similar. You review real code and write the fix yourself.\nReal depth in authentication, authorization, and multi-tenant isolation: OAuth and OIDC, RBAC, token and session handling, and the access-control bugs that only show up between two features.\nWeb and API security depth across the OWASP Top 10 classes: injection, SSRF, deserialization, and broken access control, and how these actually get exploited rather than how they are listed.\nWorking familiarity with the OWASP Top 10 for Agentic Applications and the OWASP Top 10 for LLM Applications. Excessive agency and prompt injection are live concerns in our product today.\nThreat modeling that produces engineering work with owners and dates, not a document.\nHands-on with SAST, DAST, SCA, and secrets scanning in CI, including keeping the noise low enough that teams do not turn the checks off.\nJudgment about risk. You can say what to fix now, what to accept, and why, to an audience that will push back.\nClear written and verbal communication with engineers, executives, and customers, including saying plainly what is still unknown.\nComfortable defining the structure while doing the work, in a company where requirements change week to week.\nNice to Have\nHands-on securing LLM or agentic systems: prompt injection, insecure tool use, excessive agency and permissions, sandboxing, and handling model output as untrusted input. \nSOC 2 Type I/II, ISO 27001, or similar audits taken end to end, and compliance automation tooling such as Vanta or Drata.\nEnterprise security reviews and customer questionnaires answered from the engineering seat.\nMulti-tenant B2B SaaS, and on-prem or customer-hosted deployment.\nRunning a bug bounty or coordinated disclosure program.\nSecurity capabilities delivered as an internal product, with real adoption numbers behind them.\nStanding up a product security function where none existed: charter, practices, and the culture around it.\nWhat Success Looks Like\nWhat an agent can do inside a customer's systems is bounded by design, and we can demonstrate the boundary holds.\nSecurity shows up when a feature is being designed, rather than as a gate in front of the release.\nVulnerabilities are found earlier and fixed faster, and we can show the trend.\nEnterprise security reviews stop holding up deals.\nEngineers keep the automated checks on because they are fast and usually right.\nTeams ship secure features without you in the room.\nWhy BackOps\nOwn product security at an AI-native company while the product is still being shaped.\nOur agents take real actions in customer operations, which makes this work matter more here than it does in most places.\nSmall team with real autonomy and direct access to founders and customers.\nBacked by exceptional investors and advisors.\nRewards\nCompetitive salary and meaningful equity.\nComprehensive health, dental, and vision coverage.\n401(k) plan, disability insurance, and life insurance.\nFlexible time off.\nDaily meals in the office, and regular team events and offsites.","description_format":"text","description_chars":5665,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Flexible time off","Life insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Artificial Intelligence","Logistics","Computer Vision"],"lifecycle":[{"event":"open","at":"2026-10-12T22:18:26Z"}],"visa":[],"liveness":{"score":38,"band":"fade","label":"Fading","p_open":1,"p_active":0.695,"p_room":0.55,"age_days":42,"expected_fill_days":37,"reasons":["conf:0","win:tail"],"computed_at":"2026-10-13T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/backops-product-security-engineer","json_url":"https://alion.io/job/backops-product-security-engineer.json","meta":{"generated_at":"2026-10-13T11:17:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":17398,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3801726},"rest":"https://alion.io/mcp/rest/get_company?id=3801726"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbackops-product-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbackops-product-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbackops-product-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/backops-product-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbackops-product-security-engineer"}]}