Senior Product Security Engineer: AI/LLM & AppSec

GoodLeap; United States; On-site; USD 146,000 - 185,000; Full time

Job summary

GoodLeap is hiring a Senior Product Security Engineer to partner with product and engineering, building security by default across TypeScript, Node.js, .NET, and Python stacks. You will lead production security services and review designs before code exists, ensuring robust threat modeling and proactive vulnerability management.

You’ll drive manual testing of web apps and APIs, triage findings, and help shape AI/agent security standards while supporting security tooling and IAM controls across

Qualifications

• You ship production code across multiple stacks.
• You can read unfamiliar code to validate findings and propose fixes.
• You understand identity, OAuth, and authorization failures.
• You know API security patterns and gateway-level auth.
• Hands-on testing of web apps and APIs with clear reporting.

Responsibilities

• Adversarially test AI and LLM-backed features and translate findings into criteria.
• Build and operate production security services and tooling.
• Automate manual tasks and improve existing workflows.
• Review vulnerability findings and dig deep into high-risk areas.
• Threat model from product designs and review PRDs for trust boundaries.
• Manual testing, triage exploits, and support red team activities.
• Maintain and tune the security tooling estate and IAM controls.
• Secure infrastructure and enable engineers with training and docs.
• Evaluate tools and set AI/agent security standards for production.
• Support investigations, threat hunting, and vulnerability management.

Skills

Backend engineering

TypeScript

Node.js

.NET

Python

Security testing

Threat modeling

AWS / IaC

API security

LLM security

Communication

Tools

CI/CD tooling

OpenAPI

Job description

GoodLeap is hiring a Senior Product Security Engineer to partner with product and engineering, building security by default across TypeScript, Node.js, .NET, and Python stacks. You will lead production security services and review designs before code exists, ensuring robust threat modeling and proactive vulnerability management.

You’ll drive manual testing of web apps and APIs, triage findings, and help shape AI/agent security standards while supporting security tooling and IAM controls across