Staff Product Security Engineer

endorlabs; United States; Remote; USD 180,000 - 280,000; Full time

Job summary

EndorLabs is seeking a senior security leader to set the technical direction for product security across a software platform. You will translate findings into practical fixes and safer engineering workflows while collaborating closely with engineering and product teams to influence customer-facing product decisions.

You will drive threat modeling, automation, and security tooling efforts, shaping security strategy across software supply chains, runtime monitoring, and AI agent protections.

Qualifications

• Ten+ years in application or product security with technical leadership at staff/principal level.
• Experience building and measuring security tooling or automation across an engineering org.
• Experience influencing product roadmaps and getting security improvements adopted by teams or customers.
• Hands-on experience applying LLMs or agents to security problems (finding, validating, fixing, or preventing vulnerabilities).
• Deep skills in threat modeling and secure architecture.
• Ability to set direction and influence senior stakeholders without formal authority.

Responsibilities

• Set the technical direction for product security across the software platform.
• Turn security findings into practical fixes and safer engineering workflows.
• Balance hands-on application security with threat modeling, automation, and partner with engineering and product teams.
• Shape customer-facing product decisions with security insights.
• Lead security strategy across software supply chains, first-party code, runtime monitoring, and AI agent protections.
• Evaluate how LLMs and agents can support security work and measure their limitations.

Skills

Security leadership

Threat modeling

Application security

Automation

LLMs/AI in security

Secure architecture

Influence senior stakeholders

Tools

Internal security tooling

CI/CD security

Bazel monorepos

Job description

Role overview

Set the technical direction for product security across a software platform, and turn security findings into practical fixes and safer engineering workflows. The role combines hands‑on application security with threat modeling, automation, and close partnership with engineering and product teams; it also helps shape customer‑facing product decisions.

Responsibilities

• Establish and execute security strategy across software supply chains, first‑party code, runtime monitoring, and AI agent protections.
• Investigate and prioritize vulnerabilities, drive remediation, and use internal security tooling to validate findings and fixes.
• Build security automation and engineering paths that help teams catch and prevent insecure code before it is merged.
• Conduct threat models and design reviews, and advise engineering and product teams on implementation choices and roadmap priorities.
• Evaluate how LLMs and agents can support security work, including testing tools and measuring their limitations.
• Share useful practices and product feedback with customers and the broader security community.

Requirements

• More than ten years of application or product security experience, including technical leadership at staff or principal level.
• A record of building and measuring security tools or automation used across an engineering organization.
• Experience influencing product or platform roadmaps and getting security improvements adopted by other teams or customers.
• Hands‑on experience applying LLMs or agents to security problems, such as evaluating ways to find, validate, fix, or prevent vulnerabilities.
• Deep skills in threat modeling and secure architecture.
• Able to set direction and influence senior engineering, product, and customer stakeholders without relying on formal authority.
• Comfortable investigating root causes, driving fixes, and setting priorities in an ambiguous environment.

Nice to have

• Experience securing large build systems or CI/CD environments, especially Bazel monorepos; security research in vulnerability analysis, program analysis, or static analysis; or public work such as talks, publications, and open‑source projects.