Security Engineer

RoveCode Lab; United States; Remote; USD 138,000 - 207,000; Full time

Benefits offered by this job

Remote contract role

Paid threat-model review exercise

Brief application process with runtime

Job summary

RoveCode Lab is seeking a six-month remote contract to translate a new hosted service’s security plans into testable controls with evidence-backed support. You’ll secure a developer-facing agent that runs shell commands, blending threat modeling, implementation work, penetration testing, and disclosure handling.

Responsibilities include publishing a threat model, designing SSO and provisioning controls, orchestrating the first independent pentest, remediating findings, establishing a disclosure

Qualifications

• Experience securing a product that has been reviewed by other organizations’ security teams.
• Ability to read and modify TypeScript code in the product runtime.
• Strong written communication for both technical implementation and audit contexts.
• Practical judgment to turn security policies and plans into working, verifiable controls.

Responsibilities

• Write and publish a threat model for the command-running agent, including risks from language-model-directed actions.
• Design enterprise security controls such as single sign-on, user provisioning, audit exports, and allow-lists, and verify they work as intended.
• Arrange and lead the service’s first independent penetration test.
• Own remediation of findings from the penetration test.
• Establish a responsible-disclosure process and handle incoming security reports.
• Document findings clearly for engineers and auditors.

Job description

Role overview

A six-month contract focused on turning a new hosted service’s security plans into controls that can be tested and supported by evidence. You’ll secure a developer-facing agent that runs shell commands on a user’s machine, combining threat modeling, implementation work, penetration testing, and disclosure handling.

Responsibilities

• Write and publish a threat model for the command-running agent, including the risks created by language-model-directed actions.
• Design enterprise security controls such as single sign-on, user provisioning, audit exports, and allow-lists, then verify that they work as intended.
• Arrange and lead the service’s first independent penetration test.
• Own remediation of findings from the penetration test.
• Establish a responsible-disclosure process and handle incoming security reports.
• Document findings clearly for both engineers implementing fixes and auditors reviewing evidence.

Requirements

• Experience securing a product that has been reviewed by other organizations’ security teams.
• Ability to read and modify TypeScript code in the product runtime.
• Strong written communication for both technical implementation and audit contexts.
• Practical judgment to turn security policies and plans into working, verifiable controls.

Benefits and work setup

• Remote contract role based in Europe for six months.
• The selection process includes a short application note and work links, conversations with the runtime lead and team, and a paid threat-model review exercise.