Member of Technical Staff, Product Security

Description

The company is a generative AI business that reached $1B in annual revenue run rate, with 30M+ users worldwide, 6M+ generations per day, and 390 Fortune 500 brands as customers.

The company builds AI-powered video creation and next-generation creative tools at the frontier of the field.

The role is a hands-on product security position focused on finding and fixing security vulnerabilities across the company's AI products and platforms.

The team is building agentic systems, code-generating agents, generative AI models, and enterprise applications. You will help secure new features before they reach production.

You will work closely with Product and Engineering, testing products offensively, finding architectural weaknesses, and fixing problems at their root cause. You will also turn repeated vulnerabilities into scalable security standards and automated controls.

The company is looking for someone with a documented history of finding real vulnerabilities in production systems, sound technical judgment, and the ability to work directly with engineers on more secure products.

Responsibilities

• Run hands-on penetration tests on new products and features, covering web applications, APIs, and administrative interfaces.
• Find security risks in agentic systems, MCP servers, code-generating agents, and AI-powered applications.
• Map attack surfaces on your own and uncover flaws in authorization, authentication, and multi-tenant isolation.
• Build proof-of-concept exploits, confirm findings, and retest fixes.
• Work with Engineering early in development to catch and prevent security flaws before release.
• Carry out threat modeling, architecture reviews, and security-focused code reviews.
• Read complex codebases to trace vulnerabilities to their root cause and recommend effective fixes.
• Assess risks in generative AI products, user-deployed applications, and enterprise features such as SSO and role-based access controls.
• Turn repeated vulnerabilities into secure development standards, reusable controls, and automated security checks.
• Build security tooling and add preventive controls to development and CI/CD workflows.
• Find systemic weaknesses and build fixes that stop whole classes of vulnerabilities.
• Use your knowledge of cloud, container, and infrastructure security to investigate issues across the application stack.
• Take each security finding from discovery through to remediation, working directly with engineers on lasting fixes.
• Rank vulnerabilities by exploitability, business impact, and real-world risk.
• Set practical security standards that let the product team move quickly without weakening security.
• Help define security practices for emerging AI technologies and new product architectures.

Requirements

• At least 5 years of hands-on experience in product security, application security, penetration testing, or vulnerability research.
• A record of independently finding and exploiting real vulnerabilities through application security work, bug bounty programs, or security research.
• Solid understanding of web application and API security, including authentication, authorization, and multi-tenant isolation.
• Ability to read and analyze modern codebases, identify root causes, and work with engineers on fixes.
• Experience with threat modeling, secure design reviews, and hands-on penetration testing.
• Proficiency in a scripting or programming language such as Python, JavaScript, TypeScript, or Go.
• Familiarity with cloud infrastructure, containers, and modern application architectures.
• Ability to turn security findings into scalable engineering controls and automated checks.
• Strong technical judgment, self-directed problem solving, and a proactive approach to spotting security risks.

Conditions

Base salary range is $200,000 - $300,000, depending on experience, skills, scope, and location.

The role is eligible for the company's discretionary annual bonus program.

Employees may take part in the company's stock option program.

The role is hybrid, based in the San Francisco Bay Area. You will work from the San Francisco office three full days per week and remotely the remaining days, staying available during agreed working hours with enough overlap with your team's time zone.

The team is highly experienced, moves fast, and works across international locations.

Equal opportunity employer that does not discriminate on any protected characteristic.

Benefits

• Medical, dental, and vision insurance.
• 401(k) retirement plan with company matching.
• Additional benefits and perks.