AI-Driven Product Security Engineer

Collective; San Francisco (CA); Hybrid; USD 180,000 - 240,000; Full time

Benefits offered by this job

Hybrid work in SF

Fresh lunch

Commuter support

Health reimbursement

Flexible PTO

Medical/dental/vision coverage

Parental leave

401k + equity

Team events

Job summary

Collective is hiring a Product Security Engineer to build our application security program with AI agents at the center from day one. You’ll design and operate an agentic appsec pipeline where automated testing across the stack — SAST, DAST, and SCA — pairs with AI-driven triage and pull request reviews to give engineering teams fast, high-signal feedback.

You’ll drive vulnerability remediation across the platform, ship secure defaults, lead threat modeling for new features, and evolve the

Qualifications

• 4+ years of security engineering experience with depth in application security.
• Hands-on experience with SAST, DAST, and SCA tooling integrated into CI/CD.
• Enthusiasm for building with LLMs and AI agents to automate security work.
• Software engineering ability to make well-scoped changes in production codebases (Python/Django on AWS).
• Experience driving remediation through cross-functional teams and clear reporting.

Responsibilities

• Build and operate an agentic application security program with the full testing stack integrated into CI/CD.
• Drive end-to-end vulnerability remediation and verify fixes.
• Eliminate vulnerability classes by shipping secure defaults and paved-path libraries.
• Lead threat modeling and security reviews for new features and platform changes.
• Tune rules and prompts to improve signal quality and reduce false positives.
• Stay current on fintech security trends and translate into concrete program changes.

Skills

Security engineering

SAST

DAST

SCA tooling

LLMs / AI agents

Production code changes

Tools

Semgrep

CodeQL

Bandit

OWASP ZAP

Burp Suite

Job description

Collective is hiring a Product Security Engineer to build our application security program with AI agents at the center from day one. You’ll design and operate an agentic appsec pipeline where automated testing across the stack — SAST, DAST, and SCA — pairs with AI-driven triage and pull request reviews to give engineering teams fast, high-signal feedback.

You’ll drive vulnerability remediation across the platform, ship secure defaults, lead threat modeling for new features, and evolve the