Senior Security Engineer, Product Security

Goodleap; United States; Remote; USD 150,000 - 210,000; Full time

Job summary

GoodLeap is seeking a Senior Product Security Engineer to partner with product and engineering teams to build secure by default software across TypeScript, Node.js, .NET, and Python.

You will adversarially test AI/LLM-backed features, design attack scenarios, and translate results into actionable guidance for product teams. This role requires ability to move across stacks and own security outcomes for one or more business units.

Qualifications

• Security testing of AI/LLM-backed features.
• Ability to reason about unfamiliar systems and produce actionable findings.
• Experience with production services and tooling in multiple stacks.

Responsibilities

• Adversarially test AI and LLM-backed features. Design and run attacks against LLM-backed applications and agents.
• Build and operate production security services and internal tooling across TS/Node.js/.NET/Python.

Skills

Security testing

AI/LLM security

Threat modelling

Security tooling

Prod security

Tools

TypeScript

Node.js

.NET

Python

Job description

About GoodLeap:

GoodLeap is a technology company delivering best-in-class financing and software products for sustainable solutions, from solar panels and batteries to energy-efficient HVAC, heat pumps, roofing, windows, and more. Over 1 million homeowners have benefited from our simple, fast, and frictionless technology that makes the adoption of these products more affordable, accessible, and easier to understand. Thousands of professionals deploying home efficiency and solar solutions rely on GoodLeap’s proprietary, AI-powered applications and developer tools to drive more transparent customer communication, deeper business intelligence, and streamlined payment and operations. Our platform has led to more than $30 billion in financing for sustainable solutions since 2018.

GoodLeap is also proud to support our award-winning nonprofit, GivePower, which is building and deploying life-saving water and clean electricity systems, changing the lives of more than 1.6 million people across Africa, Asia, and South America.

Position Overview

GoodLeap’s security team safeguards the organization’s information assets while enabling the business — spanning product safety and resilience, security paved roads, customer and regulatory trust, and technology governance. As a Senior Product Security Engineer, you’ll partner with product and engineering teams to make what we ship safe by default, splitting your time between building production security services and reviewing what other teams build: designs before code exists, pull requests before merge, and running systems before someone else finds the problem. You’ll be the primary security partner for one or more business units — GRC, security operations, and monitoring carry their own parts of the mandate, but you own the product security outcome. GoodLeap builds in TypeScript, Node.js, .NET, and Python, and you’ll work across all of it — we care that you can move between stacks, not that you’ve spent your career in one. We’re also shipping LLM-backed and agentic features into a regulated consumer-finance product; adversarially testing those systems (prompt injection, jailbreaks, tool abuse, exfiltration) and helping define what’s “safe enough to launch” is core to this role. You don’t need years of AI security experience — you need to show you can take an unfamiliar system, reason about how it fails, and produce findings a product team will act on.

Essential Job Duties and Responsibilities

Adversarially test our AI and LLM-backed features. Design and run attacks against LLM-backed applications and agents — prompt injection, jailbreaks, tool abuse, data exfiltration — and turn findings into pass/fail criteria product teams will act on.

Build and operate production security services. Backend services and internal tooling — APIs, streaming transports, proxy/CLI/chat interfaces — in whichever of TypeScript, Node.js, .NET, or Python fits the problem, held to the same bar as any other production service: test cove