Product Security Lead (Core Platform Security)

Quick Facts

• Role: Product Security Lead (Core Platform Security)
• Focus: Technical security leadership for user-facing application and experience layers
• Work mode: Hybrid (San Francisco, CA or Seattle/Bellevue, WA)

Description

You’ll lead security assurance for the experience/UI layer, shaping how controls are designed so secure patterns become the default. The role covers web frameworks, runtimes, rendering surfaces, and data-access APIs, including AI agent experiences and external agentic client surfaces. You’ll reduce both classic web/API risks and AI/agentic risks (prompt injection, tool abuse, memory poisoning) while mentoring teams to adopt security standards.

Responsibilities

• Lead threat modeling, security design reviews, and code reviews across web frameworks, runtimes, rendering pipelines, and underlying APIs
• Design fixes for recurring vulnerabilities such as cross-site scripting (XSS), cross-site request forgery (CSRF), server-side request forgery (SSRF), injection, and broken access control
• Own security for multi-release programs spanning teams (e.g., guest-user data access, first-party rendering into third-party surfaces)
• Reduce AI/agentic risk via controls like human approvals, least-privilege tool scoping, audit logging, and short-lived scoped credentials for Model Context Protocol (MCP) and connector integrations
• Build secure patterns into frameworks, SDKs, and rendering pipelines; author security guidelines and mentor developers

Requirements

• 8+ years in product, application, or platform security
• Bachelor’s degree in Computer Science/Engineering (or equivalent practical experience)
• Deep web/application security expertise across OWASP injection classes, XSS, CSRF, SSRF, broken access control, and the browser security model
• Hands-on experience securing modern UI frameworks, web runtimes, and rendering pipelines (including guest/unauthenticated surfaces)
• Experience securing GraphQL and REST APIs, including authentication, cross-tenant data exposure, and abuse of expensive queries
• Ability to lead threat modeling across complex web/UI/data-access environments and drive remediation
• Practical understanding of AI/LLM risks (prompt injection, tool abuse, MCP connector security) and controls preventing sensitive data from reaching an LLM
• Ability to review JavaScript/TypeScript and at least one other language (Java, Python, or Go)
• Experience writing security standards and leading cross-team programs to measurable results

Benefits

• Time off programs
• Medical, dental, vision, and mental health support
• Paid parental leave
• Life and disability insurance
• 401(k)
• Employee stock purchasing program