Security Engineer II

Security Engineer II

We're looking for a Security Engineer II to join Procore's Security Engineering team. In this role, you won't be watching dashboards and triaging tickets — you'll be building the agents that do that work for us. You will implement, test, and operate the autonomous security agents that protect our platform, data, and users, turning manual security toil into code that fixes itself.

As a Security Engineer II, you'll work alongside the senior and staff engineers who set our agentic patterns, and with Engineering, IT, GRC, and Security Operations who depend on them. Use your software skills and your security fundamentals to own individual agents end to end — the tools they call, the guardrails that contain them, and the evals that prove they work. This is the fastest path we know from operating security tools to building autonomous ones— Apply today.

This position reports into the Senior Manager, Security Engineering and will be based in our Austin, TX office. We're looking for someone to join us immediately.

What you'll do:

• Build & Ship Security Agents: Implement and deploy security agents on the paved-path patterns our engineers define, owning individual agents end to end from tool definitions through production monitoring.
• Extend the Tool Surface: Write and maintain the tools agents call — cloud queries, API integrations, remediation actions — in Python or Go, with tests, input validation, and explicit failure modes.
• Evaluate & Harden: Build and run eval suites that measure agent accuracy, catch regressions, and test resistance to prompt injection before anything reaches production.
• Automate Security Toil: Convert recurring manual work — IAM findings, cloud misconfigurations, drift in Kubernetes (EKS) and Terraform — into autonomous or human-in-the-loop remediation workflows.
• Implement Agent Identity Hygiene: Wire up short-lived, least-privilege credentials for agent workloads (OIDC federation, IRSA / workload identity) and make sure every agent action is attributable in our audit trail.
• Operate the Fleet: Monitor agents in production for cost, latency, iteration limits, and false positives; triage failures and fix the root cause in code rather than re-running by hand.
• Autonomous Asset & SBOM Workflows: Contribute to agentic pipelines for real-time asset discovery and SBOM generation, filtering output so findings are actionable rather than noise.
• Review, Document & Support: Participate in agent logic and prompt reviews, document what you build so others can reuse it, and provide on-call support for the systems you own on a rotational basis.
• On-Call: Provide on-call support on a rotational basis for the agents and pipelines you own.

What we're looking for:

• Bachelor's degree in Computer Science or equivalent practical experience, and 2+ years in a hands-on technical security or infrastructure engineering role. You'd rather ship the fix than file the ticket.
• Working Code: Proficiency in Python or Go beyond scripting — you've written software other people depend on, with tests, code review, and CI.
• Agentic Exposure: You've built or meaningfully contributed to at least one LLM-powered tool or agent, and understand tool-calling, ReAct-style loops, and retrieval. Production experience is a plus, not a requirement.
• AI-Assisted Engineering: Fluent but skeptical use of AI coding tools (Cursor, Claude Code, Copilot). You use them to move fast, and you still read every diff you ship.
• Security Fundamentals: Solid grounding in identity and access management (SAML, OAuth 2.0, OIDC, SCIM), cloud and infrastructure security, and common web/API vulnerability classes.
• Cloud & Containers: Hands-on experience with AWS security services and Kubernetes (EKS), including how workloads obtain and use credentials.
• AI Risk Awareness: Working knowledge of AI-specific risks — prompt injection, RAG data leakage, over-privileged agents (OWASP LLM Top 10) — and why an agent with tool access is a different risk object than a chatbot.
• Prompts as Code: Willingness to treat prompts and agent logic as version-controlled, testable engineering artifacts rather than one-off experiments.
• Communication & Growth: Clear written communication, a collaborative attitude, and real appetite to grow from operating security tools into building autonomous ones