{"id":2460629,"url":"https://alion.io/job/tracelink-inc-product-security-engineer-senior","title":"Product Security Engineer, Senior","company":{"id":59632,"name":"Tracelink Inc","domain":"tracelink.com","url":"https://alion.io/company/tracelink-inc","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":75,"open_postings":5,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-25T05:49:26Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Pune, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":19000,"max_usd":41000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":11},"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"EPSS","optional":false},{"name":"JavaScript","optional":false},{"name":"LLM","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"SBOM","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Red Teaming","optional":true}],"status":"live","first_seen_at":"2026-09-22T06:40:57Z","employer_posted_date":"2026-10-21","last_verified_at":"2026-10-25T12:10:53Z","board_verified":true,"closed_at":null,"days_open":33,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":33},"description":"Company overview:\nTraceLink is the world’s largest Agentic Business Network, enabling life sciences and healthcare companies to build and manage a scalable digital workforce of governed, no-code AI agents that execute and coordinate mission-critical supply chain operations alongside human teams. Powered by the Integrate-Once™ OPUS platform, TraceLink links more than 300,000 network participants, enabling multi-enterprise processes at global scale.\nFounded in 2009 with the simple mission of protecting patients, today Tracelink has 5 global offices, over 800 employees and more than 1700 customers in over 60 countries around the world. Our expanding product suite continues to protect patients and now also enhances multi-enterprise collaboration through innovative new applications such as MINT.\nTracelink is recognized as an industry leader by Gartner and IDC, and for having a great company culture by Comparably.\nAs part of the Product Security team, you will help secure and advance TraceLink's products and internal application development. Working closely with Product Managers, Architects, Software Engineers, and Security and continually improve how security is built into the software development lifecycle, including AI aspects.\nThis is a senior individual contributor role. You will take on our hardest and least-defined product security problems, act as the security technical lead on major products and initiatives, and work with a high degree of autonomy. You are trusted to scope your own work, decide how a problem should be approached, and deliver with minimum supervision. You will remain deeply hands-on running assessments, reading and writing code, building the tooling and patterns that other engineers reuse.\nIt increasingly also means securing AI-enabled product capabilities and the agentic tooling inside our own development pipeline, an area where the right answers are still being written and where we expect you to help work them out.\nWhat you will do:\nPartner with Engineering across the SDLC\nServe as senior security SME for engineering by supporting secure architecture, security requirements, and design reviews\nLead threat modeling including abuse and misuse cases for AI-enabled and agentic features\nSecure coding guidance for Java and JavaScript, manual and automated code review, including review of AI-assisted and agent-generated code\nTriage and validate findings from SAST, SCA, DAST and secrets scanning, separating signal from noise and driving fixes to closure and tuning or retiring rules that produce more noise than value\nHands-on security assessments and white-box testing of services, APIs, and multi-tenant boundaries\nAuthor the secure design patterns, guidance, and reusable components that engineering teams build against by default\nBuild the paved road\nBuild and improve automation and guardrails in our CI/CD pipelines including pre-merge checks, policy-as-code, and golden paths that make secure the default rather than a gate\nUse AI and LLM tooling to scale security work by finding triage, code review, test generation, remediation guidance - with human verification of the output\nMaintain and tune the existing security toolchain, evaluate and pilot new tooling, bringing a clear technical recommendation when it is time to adopt or drop something\nDrive innovation and maturity in the SDLC with new toolsets and automation\nTrack coverage, false-positive rate, time to remediate, and act on what they show\nSecure our AI features and AI supply chain\nReview LLM and agent-backed features for prompt injection, excessive agency and data leakage\nMaintain clear security guidelines and controls for agentic code contributions, ensuring code review standards, proper attribution, and appropriate access safeguards\nImplement safeguards that detect and block unapproved or malicious changes introduced by AI agents\nApply references such as the OWASP Top 10 for LLM Applications and MITRE ATLAS as practical engineering checklists against real attack paths and write our own guidance wherever necessary\nSoftware supply chain and vulnerability management\nMaintain supply chain integrity through SBOM accuracy, build provenance, and artifact signing\nDrive risk-based vulnerability prioritization using reachability, exploitability, and EPSS against agreed SLAs\nServe as technical lead during PSIRT response for significant product vulnerabilities\nSupport customer-facing vulnerability communications and drive the systemic fixes that prevent recurrence\nGrow the practice, inside and out\nDevelop and deliver training, run office hours and threat modeling workshops, and support security champions program\nMaintain expertise in application security, emerging threat vectors, and attacker tradecraft and improve standards accordingly\nRepresent TraceLink's security practice externally through customer conversations, written content, and conference or community participation\nSkills and Requirements:\n7+ years in application or product security or software engineering with substantial security ownership\nHands-on experience applying threat modeling or other risk identification techniques\nStrong knowledge of application security testing tools across SAST, SCA, DAST, secrets, IaC and a clear-eyed view of what each one does and doesn't catch\nDeep understanding of the OWASP Top 10 for web, APIs and AI/LLM, including avoidance and remediation techniques, and the ability to explain real exploitability to an engineer\nStrong knowledge of secure coding practices in Java and/or JavaScript able to read code fluently and submit remediation pull requests\nExperience remediating complex enterprise-level security issues end to end\nWorking knowledge of cloud environments (ideally AWS and Azure) and CI/CD pipelines\nA working understanding of how LLM-based features and AI coding assistants change the risk picture and the curiosity to go deeper\nStrong analytical and problem-solving skills\nStrong verbal and written communication skills, with both engineering and non-engineering audiences\nPreferred Skills:\nFamiliarity with AWS and Azure services\nKnowledge of microservices, event-driven architecture and multi-tenant SaaS isolation\nExperience with ASPM platforms and reachability-based vulnerability prioritization\nExperience securing or red teaming AI, ML, or agentic systems\nPenetration testing, CTF experience, a hacker's mindset\nBachelor's degree or equivalent experience in Computer Science, Information Systems Security, or a related field\nPlease see the Tracelink Privacy Policy for more information on how Tracelink processes your personal information during the recruitment process and, if applicable based on your location, how you can exercise your privacy rights. If you have questions about this privacy notice or need to contact us in connection with your personal data, including any requests to exercise your legal rights referred to at the end of this notice, please contact .","description_format":"text","description_chars":6971,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Biotechnology","Transportation & Logistics","Supply Chain"],"lifecycle":[{"event":"open","at":"2026-10-13T17:16:52Z"}],"visa":[],"liveness":{"score":57,"band":"ok","label":"Likely open","p_open":1,"p_active":0.756,"p_room":0.75,"age_days":32,"expected_fill_days":35,"reasons":["conf:1","velocity","win:late"],"computed_at":"2026-10-25T05:49:26Z"},"pay":null,"html_url":"https://alion.io/job/tracelink-inc-product-security-engineer-senior","json_url":"https://alion.io/job/tracelink-inc-product-security-engineer-senior.json","meta":{"generated_at":"2026-10-25T14:25:35Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":20778,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-26T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":59632},"rest":"https://alion.io/mcp/rest/get_company?id=59632"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftracelink-inc-product-security-engineer-senior"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftracelink-inc-product-security-engineer-senior"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftracelink-inc-product-security-engineer-senior"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/tracelink-inc-product-security-engineer-senior\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftracelink-inc-product-security-engineer-senior"}]}