Senior Product Security Engineer

Function; United States; On-site; USD 150,000 - 190,000; Full time

Benefits offered by this job

Choose your own holidays

Health Insurance

401k Match

Job summary

Function Health is seeking a Senior Product Security Engineer to partner with engineering and product teams to embed security into design, code, test, and deployment. This hands-on, impact-driven role focuses on AI-first code review, autonomous testing, and security gates that operate with minimal human input.

You will drive threat modeling, vulnerability discovery, and secure-by-default controls. You will shape the security roadmap and build tools that raise the bar across our platforms while

Qualifications

• 5+ years of experience in product or application security, software engineering, or a combination of both.
• Experience embedding security into CI/CD pipelines, not just recommendations.
• Strong Python experience, with familiarity in FastAPI and modern frameworks.
• Experience building or operating AI-assisted security tooling or agents.
• Bonus: HIPAA/healthcare data, red teaming, or security architecture at scale.

Responsibilities

• Embed security into CI/CD and drive secure-by-default deployment gates.
• Design and deploy AI-powered security agents into CI/CD pipelines.
• Build and operate the security tooling layer across pipelines (SAST, SCA, secrets, IaC).
• Conduct threat modeling, secure design reviews, and manual security assessments.
• Identify vulnerabilities proactively and drive remediation with engineering teams.
• Serve as embedded security voice across product pillars to avoid bottlenecks.
• Shape rollout of secure development frameworks and controls.
• Link application telemetry to detection and response systems.
• Contribute to incident response and postmortems for product security.

Skills

Python

FastAPI

LangChain

Agentic frameworks

AI security tooling

Tools

SAST

SCA

Secrets scanning

IaC validation

Supply chain security

Job description

• Function Health is building out a dedicated product security team to protect our members and platform as we scale. As a Senior Product Security Engineer, you’ll work shoulder-to-shoulder with engineering and product teams to embed security into every stage of development: design, code, test, and deploy. This role is hands-on and impact-driven. You’ll be expected to identify risks, build guardrails, and ship tools that raise the security bar without slowing teams down
• Our engineering org is moving toward AI-first code review, autonomous adversarial testing, and security gates that run without human approval for low-risk changes. You’d be building the systems that make that possible and safe. If you’ve been waiting for a security role where the answer to "can we automate this?" is usually yes, this is it
• Design and deploy AI-powered security agents into CI/CD: automated code review, risk classification, escalation logic, and where possible, auto-remediation
• Build and operate the security tooling layer across our pipelines: SAST, SCA, secrets scanning, IaC validation, and supply chain integrity checks
• Conduct threat modeling, secure design reviews, and manual security assessments across our apps, APIs, and infrastructure
• Find vulnerabilities through proactive testing, not just scanner output, and drive them to remediation
• Partner with engineering teams across our product pillars as the embedded security voice in the room, without being a blocker
• Own the rollout of secure-by-default development frameworks and controls
• Connect application-level telemetry to detection and response systems
• Contribute to incident response and postmortems when product security is involved
• Shape our long-term product security strategy and roadmap
• Your dedication to these responsibilities will directly contribute to the success of our platform and the satisfaction of our users. We are looking for a proactive, skilled, and forward-thinking individual to join our team and help shape the future of our services

Benefits

• Choose your own holidays
• Health Insurance
• 401k Match

We’re looking for someone who thrives on solving hard technical problems, knows how to build security into systems the right way, and is excited about what AI-assisted engineering means for the future of the discipline5+ years of experience in product or application security, software engineering, or a combination of bothExperience embedding security into CI/CD, not just recommending itStrong Python experience. Familiarity with FastAPI, LangChain, or agentic frameworks is a plusYou can guide engineers through secure design decisions without slowing them downYou’ve built or operated AI-assisted security tooling, whether that’s an agent doing code review, an automated triage pipeline, or custom security automation you designed from scratchBonus: experience with HIPAA or healthcare data, red teaming, or security architecture at scaleDeep fluency in identifying and exploiting web, API, and application vulnerabilities, well beyond OWASP Top 10You write documentation and design docs without being asked