Lead Product Security Engineer, AI Platform

BackOps AI; San Francisco (CA); On-site; USD 170,000 - 210,000; Full time

Benefits offered by this job

Equity

Health coverage

401k

Flexible PTO

Office meals & events

Job summary

BackOps AI in the San Francisco Bay Area is hiring its first dedicated product security engineer. You will own the security of the BackOps product end to end, build the secure development lifecycle, and ship guardrails that keep engineers secure without slowing innovation.

In this hands-on role, you will read code, write fixes, and collaborate with engineering, infrastructure, and product to define secure-by-design practices as the company scales.

Qualifications

• 5+ years in product or application security engineering, or a software engineer who moved into security
• Strong coding skills in Python, Go, or TypeScript, and ability to review real code
• Depth in authentication, authorization, and multi-tenant isolation: OAuth/OIDC, RBAC, tokens
• OWASP Top 10 for web, APIs, and agentic apps, with practical exploit understanding

Responsibilities

• Own product security end to end for the BackOps product
• Define and implement the secure development lifecycle with design and code review standards
• Run vulnerability management end to end: find, prioritize, fix, verify
• Lead security reviews, penetration tests, and coordinated vulnerability disclosure
• Extend controls to customer-hosted and on-prem deployments

Skills

Security engineering

Programming in Python/Go/TypeScript

OAuth/OIDC & RBAC

Threat modeling

Written & verbal communication

Tools

SAST

DAST

SCA

Secrets scanning

Job description

BackOps AI in the San Francisco Bay Area is hiring its first dedicated product security engineer. You will own the security of the BackOps product end to end, build the secure development lifecycle, and ship guardrails that keep engineers secure without slowing innovation.

In this hands-on role, you will read code, write fixes, and collaborate with engineering, infrastructure, and product to define secure-by-design practices as the company scales.