Lead Product Security Engineer for SaaS & AI

assembledhq; New York (NY); On-site; USD 150,000 - 210,000; Full time

Job summary

Assembled seeks a security engineer to own application security across our SaaS and AI products. You will work with product managers and engineers to establish security practices, influence architecture, and build tooling to manage vulnerabilities from discovery to remediation.

You will lead threat modeling, secure design reviews, and vulnerability management, and integrate controls for secrets and dependencies within CI/CD pipelines.

Qualifications

• 3+ years of hands-on application security experience.
• Experience writing and reviewing production code.
• Ability to balance security with product goals and shipping.
• Experience using AI tools for security investigation, testing, or remediation.

Responsibilities

• Lead threat modeling, secure design reviews, and vulnerability management across SaaS and AI products and the underlying infrastructure.
• Integrate and automate controls for secrets, access, and dependency security within engineering workflows and CI/CD pipelines.
• Establish and maintain code, dependency, and secrets scanning, alongside dynamic application security testing.
• Coordinate with third-party penetration testers and manage external vulnerability reporting and triage.
• Develop secure design and coding training for engineers and establish processes for routing security issues.
• Respond to security incidents involving application vulnerabilities and coordinate remediation efforts.

Skills

Application security

Threat modeling

Code reviews

Vulnerability remediation

AI security tooling

Job description

Assembled seeks a security engineer to own application security across our SaaS and AI products. You will work with product managers and engineers to establish security practices, influence architecture, and build tooling to manage vulnerabilities from discovery to remediation.

You will lead threat modeling, secure design reviews, and vulnerability management, and integrate controls for secrets and dependencies within CI/CD pipelines.