{"id":3948115,"url":"https://alion.io/job/nominal-product-security-engineer","title":"Product Security Engineer","company":{"id":63575,"name":"Nominal","domain":"nominal.io","url":"https://alion.io/company/nominal","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Gem","truth_index":{"grade":"A","score":86,"open_postings":23,"ghost_share":0,"stale_share":0.565,"repost_share":0,"time_to_fill_p50_days":57,"computed_at":"2026-11-09T06:03:00Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":208000,"max":245000,"currency":"USD","period":"year","gross":null,"usd_annual":245000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"CVE","optional":false},{"name":"Kubernetes","optional":false},{"name":"NIST 800-53","optional":false},{"name":"SBOM","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-11-06T04:58:53Z","employer_posted_date":"2026-11-08","last_verified_at":"2026-11-09T07:58:04Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"About Nominal\nEngineers today are building some of the most ambitious machines humanity has ever seen. They should have AI that’s purpose-built for them.\nNominal is building the Hardware Intelligence Platform that gives engineers increased visibility into complex physical systems, helps them make better decisions, and ultimately gets their products into the real world faster. It brings together the systems, data, intelligence, and applications hardware engineering requires to meet the AI moment. Hardware engineering teams use Nominal to simulate, test, manufacture, and operate the physical systems that keep the world moving, from spacecraft and autonomous vehicles to next-generation energy systems and robotics.\nOur customers span aerospace, defense, manufacturing, transportation, energy, and robotics. They include Anduril, Shield AI, Wisk Aero, Pratt Miller Motorsports, Antares, and Shinkei Systems, amongst others, alongside programs within the U.S. Air Force and Navy. Our team draws from SpaceX, Palantir, Anduril, Applied Intuition, Tesla, and other leading companies, united by a common mission: giving hardware engineers the tools to build the future with speed, safety, and confidence. We're a fast-moving team that owns problems end-to-end, works across disciplines, and thrives at the intersection of hardware and software.\nSome of the world’s leading technology investors, including Sequoia, Lightspeed, Founders Fund, General Catalyst, Lux Capital, and Insight Partners, are backing Nominal’s ambition to change how machines are built and operated. We’re looking for engineers who want to take on hard problems and help make a new generation of world-changing hardware possible.\nAbout the role\nOur customers trust us with the data and controls behind their hardware programs, so the security of our platform is part of the product itself. It has to be designed in from the first architecture review and held up through every release, not checked at the end. Product Security is the function that makes that the default for how we build.\nWe’re looking for a Product Security Engineer to do that work. You’ll review designs for new services and features, build the SAST, SCA, secrets-scanning, and DAST gates that run in our pipelines, and own fixing what they find, from CVE remediation to penetration test follow-up. Your influence will come from being useful to the engineers shipping code. Because this is a standalone function, it’s up to you to set the standard for what good looks like.\nThis is a high-ownership role for a software engineer who has moved into security and knows that secure products are designed in, not bolted on at the end.\nWhat you’ll do\nLead threat modeling and security design reviews for new services and features, so design flaws are found and fixed before code ships.\nArchitect and own SAST, SCA, and secrets-scanning gates in our CI/CD pipelines, tuned so engineers trust the results and act on them.\nOwn our DAST program, from tool selection and coverage through triage of findings with the teams that own the affected services.\nRun product vulnerability management, including the CVE remediation workflow and SLAs, and drive fixes across multiple engineering teams.\nDefine secure SDLC standards and enable developers with guidance, tooling, and examples they can apply without security in the loop.\nScope and coordinate penetration tests, then drive remediation of findings to closure with the responsible teams.\nDefine security requirements for customer-facing features and integrations, and mentor engineers on applying them.\nWe’re looking for someone with\nStrong software engineering background, including experience building and reviewing production services in at least one modern language.\nHands-on experience performing threat modeling and security design reviews for distributed systems or cloud-hosted services.\nExperience operating application security tooling in CI/CD pipelines, such as SAST, SCA, secrets scanning, and DAST.\nExperience running a vulnerability management process, including triage, prioritization by real exploitability, and remediation tracking against SLAs.\nExperience scoping penetration tests and working with testers and engineering teams to close findings.\nA record of writing security standards or requirements that engineering teams adopt in practice.\nAbility to lead cross-team work and make risk-based decisions amid ambiguity, influencing engineers without direct authority.\nSkills that supercharge us\nExperience securing software deployed on-prem or in air-gapped environments.\nFamiliarity with defense or aerospace compliance frameworks, such as NIST 800-53 or 800-171, or experience shipping software under ITAR or CUI constraints.\nHands-on use of software supply chain security practices, such as SBOM generation and artifact signing.\nCertified Kubernetes Security Specialist (CKS) certification, or equivalent hands-on experience securing Kubernetes workloads.\nExperience building a product security program from an early stage.\nBenefits/Perks\n 100% covered health, dental, and vision insurance (for you and your family)\n Unlimited paid vacation\n 12 weeks parental leave\n Fertility and family planning ($15,000 lifetime)\n Lunch provided daily\n Wellness stipend ($100/month)\n $500/year hardware sensor stipend\n Learning and development stipend\n 401(k)\n Employee-friendly equity terms\n In-office 5 days per week\nAll qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, or national origin.\nITAR Requirements\nTo conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here.\nCompensation\nThe base pay range for this role is $208,000 - $245,000 per year.","description_format":"text","description_chars":6035,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":true,"languages":[]},"benefits":["Equity","Parental leave","Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Manufacturing & Industrial Software"],"lifecycle":[{"event":"open","at":"2026-11-08T23:16:25Z"}],"visa":[],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.602,"p_room":1,"age_days":3,"expected_fill_days":57,"reasons":["conf:2","stale_co","win:early"],"computed_at":"2026-11-09T06:03:00Z"},"pay":{"stated_usd_annual":245000,"is_top_pay":true},"html_url":"https://alion.io/job/nominal-product-security-engineer","json_url":"https://alion.io/job/nominal-product-security-engineer.json","meta":{"generated_at":"2026-11-09T08:27:16Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6810,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-10T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":63575},"rest":"https://alion.io/mcp/rest/get_company?id=63575"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnominal-product-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnominal-product-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnominal-product-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/nominal-product-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnominal-product-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3948115}},{"tool":"search_jobs","arguments":{"company":"nominal.io","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3948115},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}