Remote Security Engineer — Threat Modeling & Pen Tests

RoveCode Lab; United States; Remote; USD 138,000 - 207,000; Full time

Benefits offered by this job

Remote contract role

Paid threat-model review exercise

Brief application process with runtime

Job summary

RoveCode Lab is seeking a six-month remote contract to translate a new hosted service’s security plans into testable controls with evidence-backed support. You’ll secure a developer-facing agent that runs shell commands, blending threat modeling, implementation work, penetration testing, and disclosure handling.

Responsibilities include publishing a threat model, designing SSO and provisioning controls, orchestrating the first independent pentest, remediating findings, establishing a disclosure

Qualifications

• Experience securing a product that has been reviewed by other organizations’ security teams.
• Ability to read and modify TypeScript code in the product runtime.
• Strong written communication for both technical implementation and audit contexts.
• Practical judgment to turn security policies and plans into working, verifiable controls.

Responsibilities

• Write and publish a threat model for the command-running agent, including risks from language-model-directed actions.
• Design enterprise security controls such as single sign-on, user provisioning, audit exports, and allow-lists, and verify they work as intended.
• Arrange and lead the service’s first independent penetration test.
• Own remediation of findings from the penetration test.
• Establish a responsible-disclosure process and handle incoming security reports.
• Document findings clearly for engineers and auditors.

Job description

RoveCode Lab is seeking a six-month remote contract to translate a new hosted service’s security plans into testable controls with evidence-backed support. You’ll secure a developer-facing agent that runs shell commands, blending threat modeling, implementation work, penetration testing, and disclosure handling.

Responsibilities include publishing a threat model, designing SSO and provisioning controls, orchestrating the first independent pentest, remediating findings, establishing a disclosure