{"id":157771,"url":"https://alion.io/job/goodleap-senior-security-engineer-product-security","title":"Senior Security Engineer, Product Security","company":{"id":6926,"name":"GoodLeap","domain":"goodleap.com","url":"https://alion.io/company/goodleap","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":79,"open_postings":6,"ghost_share":0,"stale_share":0.833,"repost_share":0,"time_to_fill_p50_days":34,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":146300,"max":186600,"currency":"USD","period":"year","gross":null,"usd_annual":186600},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":".NET","optional":false},{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"DNS","optional":false},{"name":"GraphQL","optional":false},{"name":"IAM","optional":false},{"name":"LLM","optional":false},{"name":"Node JS","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"Rest API","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"C#","optional":true},{"name":"Go","optional":true},{"name":"JavaScript","optional":true},{"name":"Least Privilege","optional":true}],"status":"live","first_seen_at":"2026-08-28T21:56:58Z","employer_posted_date":"2026-08-28","last_verified_at":"2026-10-23T13:37:13Z","board_verified":true,"closed_at":null,"days_open":55,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":55},"description":"Position Overview\nGoodLeap’s security team safeguards the organization’s information assets while enabling the business - spanning product safety and resilience, security paved roads, customer and regulatory trust, and technology governance. As a Senior Product Security Engineer, you’ll partner with product and engineering teams to make what we ship safe by default, splitting your time between building production security services and reviewing what other teams build: designs before code exists, pull requests before merge, and running systems before someone else finds the problem. You’ll be the primary security partner for one or more business units - GRC, security operations, and monitoring carry their own parts of the mandate, but you own the product security outcome.\nGoodLeap builds in TypeScript, Node.js, .NET, and Python, and you’ll work across all of it - we care that you can move between stacks, not that you’ve spent your career in one. We’re also shipping LLM-backed and agentic features into a regulated consumer-finance product; adversarially testing those systems (prompt injection, jailbreaks, tool abuse, exfiltration) and helping define what’s “safe enough to launch” is core to this role. You don’t need years of AI security experience - you need to show you can take an unfamiliar system, reason about how it fails, and produce findings a product team will act on.\nEssential Job Duties and Responsibilities\nAdversarially test our AI and LLM-backed features. Design and run attacks against LLM-backed applications and agents - prompt injection, jailbreaks, tool abuse, data exfiltration - and turn findings into pass/fail criteria product teams will act on.\nBuild and operate production security services. Backend services and internal tooling - APIs, streaming transports, proxy/CLI/chat interfaces - in whichever of TypeScript, Node.js, .NET, or Python fits the problem, held to the same bar as any other production service: test coverage, CI, dependency management. \nFind new ways to automate the work. Notice when something we do by hand has become automatable, prototype it, and make the case- even when it means replacing a tool we bought last year. \nReview pull request vulnerability findings. Triage what scanning and AI-assisted review surface across our stacks, separating real findings from noise. Go deep by hand on auth paths and high-risk changes, and feed what you learn back into the tooling. \nThreat model from product designs. Review PRDs and technical designs before code exists, infer trust boundaries and data flows in unfamiliar domains, and raise security questions while the design is still cheap to change.\nTest by hand and validate what you find. Manual testing of web applications and APIs, triage for real exploitability, and retest fixes. Support the red team’s bug bounty and continuous penetration testing programs. \nKeep the AppSec tooling estate running and low-friction. SAST/dependency scanning tuning, finding triage and routing, SSO and access management, and automating the repetitive parts so the program scales without headcount. \nSecure the infrastructure your tooling runs on. IAM least-privilege scoping, secrets management, and container/network lifecycle - as infrastructure as code, with automated drift checks. \nEnable engineers to do the right thing. Build security training and documentation engineers will actually use. \nEvaluate tools and help set the AI bar. Run structured bake-offs of security products against defined requirements and help set the standards AI/agent systems must satisfy before reaching production. \nBack up the rest of the security team. Support investigations, threat hunting, and incident response for the products you cover, and contribute to the vulnerability management lifecycle and security analytics platform.\nRequired Skills, Knowledge, and Abilities\nYou ship production code. Strong backend engineering in at least one modern language, with at least one service you built that others depend on - async patterns, HTTP APIs, and streaming transports are familiar ground. We work across TypeScript, Node.js, .NET, and Python; depth in one plus the willingness to move between them matters more than any particular stack on your résumé.\nYou can read code you didn’t write, across more than one language and stack, well enough to judge whether a reported finding is real, catch the ones tooling missed, and propose a fix the engineer can act on.\nYou know how identity and authorization actually fail: token exchange and scope handling, session lifetime and revocation, request signing, OAuth pitfalls, and network-layer issues like SSRF and DNS rebinding. We’re looking for reasoning that finds real bugs, not checklist recall.\nYou understand API standards and how to secure them: REST and GraphQL in practice, OpenAPI and schema contracts, input validation, rate limiting, gateway-level auth, and webhook and service-to-service verification.\nHands-on testing of web applications and APIs - manual, not just scanner-driven - plus the triage, the clear write-up, and the retest.\nThreat modeling from written designs. You can read a PRD in an unfamiliar domain, infer trust boundaries and data flows, and ask the right questions while the answer is still cheap.\nWorking AWS and infrastructure-as-code competence: IAM scoping, secrets management, container/compute lifecycle, network egress control, and infrastructure defined as code.\nPractical exposure to AI/LLM security. You have attacked an LLM-backed application or agent - at work, in a CTF, in published research, or in your own lab - and can tell us what you found and why it worked.\nYou write and speak for people who are not in security. Findings engineers act on, documentation they use, and explanations that hold up in front of a product manager, an executive, or Legal.\nPreferred:\nHaving owned an AppSec tooling estate: SAST/SCA tuning, finding routing, false-positive reduction\nRunning structured vendor evaluations or proofs of concept\nContributing to security policy or standards, including for AI systems\nDelivering security training or building hands-on learning environments\nDepth in cryptography and key management\nDetection engineering, incident response, or threat hunting exposure\nAn understanding of how SaaS products get built - roadmaps, prioritization, why the ship date exists. Prior product or engineering management experience is a plus, not an expectation.","description_format":"text","description_chars":6443,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Software & Embedded Finance","Mortgage Lending & Brokers"],"lifecycle":[{"event":"open","at":"2026-08-28T21:56:58Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 27 · green card filings: 2","filings_12m":27,"filings_prev_12m":13,"green_card_filings_12m":2,"median_offered_wage_usd":160431,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":1}],"liveness":{"score":31,"band":"fade","label":"Fading","p_open":1,"p_active":0.694,"p_room":0.45,"age_days":55,"expected_fill_days":34,"reasons":["conf:1","velocity","win:tail"],"computed_at":"2026-10-23T05:54:15Z"},"pay":{"stated_usd_annual":186600,"is_top_pay":true},"html_url":"https://alion.io/job/goodleap-senior-security-engineer-product-security","json_url":"https://alion.io/job/goodleap-senior-security-engineer-product-security.json","meta":{"generated_at":"2026-10-23T15:39:00Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":23478,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6926},"rest":"https://alion.io/mcp/rest/get_company?id=6926"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgoodleap-senior-security-engineer-product-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgoodleap-senior-security-engineer-product-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgoodleap-senior-security-engineer-product-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/goodleap-senior-security-engineer-product-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgoodleap-senior-security-engineer-product-security"}]}