Senior Product Security Engineer — AI/LLM & AppSec

GoodLeap; United States; On-site; USD 146,000 - 169,000; Full time

Benefits offered by this job

Bonus eligible

Job summary

GoodLeap is seeking a Senior Product Security Engineer to partner with product and engineering teams, building security by default across TypeScript, Node.js, .NET, and Python stacks. You’ll review designs before code, triage vulnerabilities, and support AI/LLM features in a regulated consumer-finance product.

You’ll act as the primary security partner for one or more business units, with responsibilities spanning threat modeling, manual testing, and tooling automation.

Qualifications

• Proficient in at least one modern language with production services.
• Read unfamiliar code across languages and propose fixes.
• Understand identity/authorization failures and mitigations.
• Secure REST/GraphQL APIs and contracts (OpenAPI).
• Hands-on testing of web apps and APIs; manual and automated.
• Threat modeling from designs and data flows.
• AWS plus infrastructure-as-code mindset.
• Practical exposure to AI/LLM security.
• Communicate findings clearly to engineers and product teams.

Responsibilities

• Adversarially test AI/LLM features; design and run attacks and define pass/fail criteria.
• Build and operate production security services and tooling across stacks.
• Automate repetitive security tasks and tooling improvements.
• Triages vulnerability findings and deep-dives on high-risk areas.
• Threat model product designs before code exists and raise questions.
• Manual testing of web apps and APIs, retest fixes.
• Maintain IAM least-privilege, secrets management, and IaC drift control.
• Support red team activities and vulnerability management program.
• Help engineers ship securely by default across products.

Skills

Backend engineering

Code reading across languages

API security

Identity & authorization

AI/LLM security

Job description

GoodLeap is seeking a Senior Product Security Engineer to partner with product and engineering teams, building security by default across TypeScript, Node.js, .NET, and Python stacks. You’ll review designs before code, triage vulnerabilities, and support AI/LLM features in a regulated consumer-finance product.

You’ll act as the primary security partner for one or more business units, with responsibilities spanning threat modeling, manual testing, and tooling automation.