Member of Technical Staff, Product Security

present of AI; San Francisco (CA); On-site; USD 120,000 - 160,000; Full time

Job summary

Higgsfield is seeking a hands-on Member of Technical Staff, Product Security in San Francisco to break and fix new AI-enabled products before launch. You will identify vulnerabilities in web apps and APIs, especially around login, permissions, and data separation, and work with engineers to turn bugs into automated checks.

The role emphasizes secure AI design, scalable security practices, and rapid integration of fixes.

Qualifications

• Hands-on security experience focusing on finding and exploiting vulnerabilities in web apps and APIs.

Responsibilities

• Hands-on security role focused on breaking and fixing new products before launch.
• Real vulnerabilities found and exploited.
• Web and API penetration testing.
• Multi-tenant isolation and access control.
• Security code review and root causes.
• Automated security checks in CI/CD.

Skills

Web security

API security

Vulnerability assessment

Job description

Member of Technical Staff, Product Security

This is a hands-on security role focused on breaking and fixing new products before launch. It calls for real experience finding and exploiting vulnerabilities in web apps and APIs, especially around logins, permissions, and keeping customer data separate. A strong candidate reads unfamiliar code well, works easily with engineers, and turns repeated bugs into standards and automated checks.

How it fits the AI era

The products here include agents, code-writing tools, and tool servers, which open up new kinds of attack paths that older security checklists do not cover. AI can speed up code review and testing, but deciding what is truly risky, judging real-world impact, and persuading a fast-moving team to fix root causes stays with people. Part of the job is helping define security practices for AI designs that are still new.

How it builds AI experience

Working on a platform that generates video and images from text, images, and links gives direct exposure to securing generative AI features, agentic systems, and user-deployed apps. Someone building this experience could practice testing AI agents and tool integrations for permission and isolation flaws, then write up the findings. Bug bounty work on AI products is another practical route.

Worth showing

• Real vulnerabilities found and exploited
• Web and API penetration testing
• Multi-tenant isolation and access control
• Security code review and root causes
• Automated security checks in CI/CD

This is our own read, written from the employer's posting and the company's Spotlight. The employer's posting is the source of truth for the role.

About Higgsfield

Higgsfield is an AI-native creative suite that generates cinematic-quality video and images from text, image, or link inputs, per the company.