{"id":1419621,"url":"https://alion.io/job/mirrorweb-product-security-engineer","title":"Product Security Engineer","company":{"id":1849817,"name":"MirrorWeb","domain":"mirrorweb.com","url":"https://alion.io/company/mirrorweb-com","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"BambooHR","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Manchester, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":97000,"max_usd":221000,"period":"year","method":"role_country_seniority_unknown","sample_n":3177},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Claude","optional":false},{"name":"Claude Code","optional":false},{"name":"Cursor","optional":false},{"name":"IAM","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"OpenAI Codex","optional":false},{"name":"Sigstore","optional":false},{"name":"SLSA","optional":false},{"name":"SOC 2","optional":false},{"name":"AI Agents","optional":true},{"name":"Amazon Aurora","optional":true},{"name":"Amazon EC2","optional":true},{"name":"Amazon ECS","optional":true},{"name":"Amazon S3","optional":true},{"name":"AWS Bedrock","optional":true},{"name":"AWS Fargate","optional":true},{"name":"AWS Lambda","optional":true},{"name":"ClickHouse","optional":true},{"name":"Cosign","optional":true},{"name":"Falco","optional":true},{"name":"GitHub Actions","optional":true},{"name":"Go","optional":true},{"name":"Grafana","optional":true},{"name":"JavaScript","optional":true},{"name":"Langfuse","optional":true},{"name":"MySQL","optional":true},{"name":"osquery","optional":true},{"name":"PostgreSQL","optional":true},{"name":"Python","optional":true},{"name":"React.js","optional":true},{"name":"SBOM","optional":true},{"name":"Sentry","optional":true},{"name":"Terraform","optional":true},{"name":"TypeScript","optional":true},{"name":"Vercel","optional":true}],"status":"live","first_seen_at":"2026-06-19T00:00:00Z","employer_posted_date":"2026-06-19","last_verified_at":"2026-10-17T12:52:07Z","board_verified":true,"closed_at":null,"days_open":120,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":120},"description":"What is a Product Security Engineer?\nThe hardest security problems we face aren't policy problems. They're engineering problems. Supply-chain operators. Prompt-injection campaigns. Financially-motivated attackers who turn a compromised dependency into production access. A well-organised control library doesn't move the needle there. Engineering does.\nA Product Security Engineer is a software engineer whose specialism is making those attack paths hard, expensive, or impossible. They write production code. They build detections that catch real attacks. They harden the systems other engineers depend on. They reason about specific adversaries with specific failure modes, not abstract categories.\nWe're hiring someone to defend the regulated communications record of thousands of financial firms. The data is a real target. The work is engineering work.\nWhat you'll do\nMirrorWeb is a communications compliance supervision platform. We process hundreds of millions of events a month for thousands of financial-services firms worldwide. Customers trust us with their regulated record, which is a high-value target by any threat model. You'll work across the platform: web capture, largescale data pipelines, archiving, the customer-facing product, and the developer infrastructure all of it ships on.\nEngineer defence into the product\nMulti-tenant isolation that holds up to a determined insider. Encryption and key management you'd trust on your own data. IAM modelled as code, reviewed like code, with privilege-escalation paths analysed before they ship. Application-layer hardening on the surfaces customers actually use. Security as a property of how the product is built, not a layer on top.\nDefend the supply chain\nThe path of least resistance into modern SaaS runs through dependencies, build pipelines, and CI providers. You'll engineer the systems that make our supply chain defensible: provenance and integrity for what we build (SLSA, sigstore patterns, signed artifacts), dependency trust as a real control rather than a manifest scan, build-pipeline isolation, third-party risk as runtime telemetry. When the next big supply-chain incident lands, we should know within hours whether it touches us.\nDetect, respond, contain\nRuntime detection that catches what actually happens, not what a vendor template guesses might. Incident response codified as automation: containment, rotation, isolation, evidence capture. Forensics tooling that works on our stack. Adversary emulation against our real attack surface. The metric is mean-time-tocontain, not control coverage.\nSecure the agentic development surface\nOur engineers ship with AI agents in the loop on every change. That's leverage, and it's a new attack surface: prompt injection against agent harnesses, untrusted MCP server outputs, IAM scope creep on agent-driven tooling, model and prompt supply chain. You'll own the security layer of our agent platform: sandbox boundaries, scoped credentials, provenance trails on agent-shipped changes, secure-by-default code-generation patterns.\nLead the security craft inside engineering\nYou embed inside the engineering team, not next to it. You pair with platform and product engineers on the work where threat models matter. You raise the bar through the tooling and patterns you ship, not through review gates. Compliance (SOC 2 today, more as we scale) falls out as evidence of real security work, not as a separate workstream.\nWhat we're looking for\nEssential\nSeveral years writing production software on AWS\nSecurity as your specialism, with a track record of defence systems you've shipped: detections that fired on real attacks, supply-chain or build-pipeline hardening, hardened product surfaces, IR automation that contained an incident. Be ready to talk about one in depth.\nAdversarial instincts. You follow supply-chain incidents, read post-mortems, and reason about real threat actors rather than abstract categories.\nHands-on experience using AI coding agents (Claude Code, Cursor, Codex, or similar) in production development workflows\nA clear model for how agent harnesses work (context, tool selection, trust boundaries), and where they break\nThreat-modelling fluency. You can walk a system design and come out with what's worth defending and what isn't.\nAn open communicator who raises concerns early and contributes in group discussions A high bar for resilient systems, in yourself and the people around you\nDesirable\nDetection engineering at production scale: runtime detection, anomaly detection, alert tuning (Sigma, OSQuery, Falco, or equivalent)\nSupply-chain security: SLSA, sigstore / cosign, in-toto, SBOM tooling used as a real control\nCloud-native attack patterns on AWS: IAM privilege analysis, IMDS exploitation, cross-account paths, KMS misuse, and the defences for each\nIncident response leadership end-to-end on a real incident (containment, eradication, forensics, write-up)\nAuthoring MCP servers or custom agent tools with a security lens Product Security Engineer Job Description 3\nFamiliarity with AGENTS.md / CLAUDE.md patterns and skill authoring\nCryptography in practice: key management, KMS / HSM, encryption-in-use, sensible TLS\nLarge-scale data-intensive systems: PostgreSQL, ClickHouse, Turbopuffer\nObservability tooling: Grafana, exception alerting, OpenTracing, Langfuse\nRegtech, fintech, or regulated-record experience\nScoping red-team and pentest engagements (you commission and consume offensive testing, you don't run it day-to-day)\nWhat you won't find here\nA GRC role with an engineering title. A queue of CVE tickets to triage. A SOC analyst rota. A compliance-automation role rebadged as security engineering. This role exists to defend our product against real adversaries, not to manage a control library.\nWhy MirrorWeb?\nWe're a communications compliance surveillance and supervision platform. We process hundreds of millions of events a month for firms worldwide, and we're scaling fast. Past the scrappy startup stage, still small enough that the work you do this week is in production next. Security Engineering, like Product Engineering, is a first-class softwareengineering discipline here. Not an audit function bolted onto one. We protect the regulated record for thousands of financial firms. The threat is real, and the surface is interesting.\nOur Tech Stack\nBackend: Go, TypeScript, Python\nFrontend: React, TypeScript\nCloud: AWS (Lambda, EC2, ECS Fargate, Aurora PostgreSQL/MySQL, S3, SQS/SNS), Vercel AI\nInfrastructure: AWS Bedrock, Langfuse, Vercel AI Gateway\nInfrastructure: Terraform, GitHub Actions Data: Large-scale PostgreSQL, ClickHouse, Turbopuffer\nAgent tooling: Claude Code, Cursor, Linear, Codex, Sentry, Grafana Cloud, CodeRabbit, Incident.io","description_format":"text","description_chars":6734,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":[],"lifecycle":[{"event":"open","at":"2026-09-28T21:53:51Z"}],"visa":[],"liveness":{"score":6,"band":"cold","label":"Long shot","p_open":1,"p_active":0.226,"p_room":0.28,"age_days":120,"expected_fill_days":22,"reasons":["conf:1","win:tail","crowd:"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/mirrorweb-product-security-engineer","json_url":"https://alion.io/job/mirrorweb-product-security-engineer.json","meta":{"generated_at":"2026-10-17T13:29:00Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":18126,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1849817},"rest":"https://alion.io/mcp/rest/get_company?id=1849817"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmirrorweb-product-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmirrorweb-product-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmirrorweb-product-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/mirrorweb-product-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmirrorweb-product-security-engineer"}]}