Senior Product Security Engineer — AI/LLM & AppSec

Devconnectplatform; Northern (KY); Hybrid; USD 120,000 - 190,000; Full time

Job summary

GoodLeap is hiring a Senior Product Security Engineer to partner with product and engineering to ship secure features by default. You will design, test, and deploy production security services across TypeScript, Node.js, .NET, and Python while evaluating AI/LLM risks and threat models.

You will triage vulnerability findings, participate in red team activities, and help define security standards for a regulated fintech environment. Strong backend skills and AWS/IaC experience are required.

Qualifications

• Production code shipping experience in at least one modern language.
• Ability to read unfamiliar codebases to assess findings and propose fixes.
• Strong understanding of identity, authorization, token exchange, and OAuth pitfalls.
• Hands-on testing of web apps and APIs; triage and retest of fixes.
• Threat modeling from PRDs and designs before coding starts.
• Experience with AWS and infrastructure as code practices.

Responsibilities

• Adversarially test AI and LLM-backed features and translate findings into actionable criteria.
• Build and operate production security services and tooling across TS/Node.js, .NET, or Python.
• Automate repetitive security tasks and prototype new solutions.
• Review vulnerability findings and perform deep manual triage on high-risk paths.
• Model threats from product designs and ask the right questions early.

Skills

Backend engineering

Code reading

Identity & authorization

API security

Manual testing

Threat modeling

AWS

Terraform

Tools

OpenAPI

GraphQL

OAuth

REST

SAST

SCA

Terraform

Job description

GoodLeap is hiring a Senior Product Security Engineer to partner with product and engineering to ship secure features by default. You will design, test, and deploy production security services across TypeScript, Node.js, .NET, and Python while evaluating AI/LLM risks and threat models.

You will triage vulnerability findings, participate in red team activities, and help define security standards for a regulated fintech environment. Strong backend skills and AWS/IaC experience are required.