Product Security Engineer, North Security

Cohere is the leading security-first enterprise AI company. We build cutting-edge foundation AI models and end-to-end products that are designed to solve real-world business problems. We're training and deploying frontier models for enterprises who are building AI systems. We believe that our work is instrumental to the widespread adoption of AI and we are looking for folks that want to be part of that. Each one of us is responsible for contributing to increasing the capabilities of our models and the value they drive for our customers. We are a global technology company headquartered in Toronto with key offices in London, New York City, San Francisco, Montreal, Paris, Berlin and Seoul. Enterprises hand Cohere their most sensitive data and put our models inside workflows they can't afford to get wrong. Securing that means working on problems the industry hasn't settled yet, what authorization means when an agent acts on a user's behalf, how to contain tools that consume untrusted input, and whether tenant boundaries hold when a model can be steered by the data it reads. We're hiring a Senior Product Security Engineer to work these problems alongside the engineers building the products, reviewing architecture and code, threat modeling before implementation, testing what ships, and turning what you learn into defaults other teams inherit. Secure AI-powered products. Evaluate risks such as prompt injection, unsafe tool use, identity and delegation failures, excessive agency, data exposure, tenant isolation, and sandbox escapes. Identify trust boundaries, abuse cases, and high‑impact failure modes before implementation. Perform hands‑on testing. Develop secure defaults, approved patterns, reusable controls, review requirements, and automated checks that reduce recurring risks. Pair with engineers, document practical guidance, and help product teams develop durable security expertise. Influence risk decisions. You have strong software engineering fundamentals and can independently understand, test, and contribute fixes to production codebases. You are proficient in at least one of Python, Go, or TypeScript. You have led security reviews or threat models for complex production systems and can point to meaningful design or risk improvements that resulted. You understand common vulnerability classes and their underlying design failures, including injection, authorization flaws, IDOR, SSRF, unsafe deserialization, race conditions, cryptographic misuse, and software supply‑chain risks. You understand modern application architecture, including web applications, APIs, OAuth/OIDC, cloud platforms, containers, Kubernetes, and CI/CD systems. You can reason rigorously about untrusted input, authorization, isolation, identity, delegation, and data boundaries. Direct experience with agentic AI systems is valuable but not required. Experience building or operating security tooling such as SAST, DAST, SCA, custom linters, or policy‑as‑code. Experience securing multi‑tenant SaaS, enterprise software, or systems that process sensitive customer data. Offensive security experience through penetration testing, red teaming or security research. Contributions to open‑source security projects, published research, conference talks, or credited vulnerability discoveries. Full-Time Employees at Cohere enjoy these Perks: ~ A weekly lunch stipend of $75/£75 or equivalent in your local currency for lunch. ~ Full health and dental benefits, including a separate budget for mental health. ~ RRSP matching, 401K, Pension Scheme. ~Arts & culture, fitness/wellness, quality time, and a workspace improvement credit. Education & learning stipend for conferences, courses, and coaching. ~Budget for traveling to other offices if you are remote, plus an annual company offsite. Cohere is remote‑friendly, but we also have offices in Toronto, London, New York City, San Francisco, Montreal, Paris, Berlin and Seoul with more opening soon. For those in the office: a daily lunch program, plenty of snacks, and regular community and social events. For those not near an office: a co‑working benefit so you can work alongside others in your city. Everyone receives a $500 home office stipend to set up your workspace properly. We may use AI‑enabled tools to screen and assess applicants against the criteria for this position. This helps our recruiters identify potentially qualified candidates, but it doesn't limit the applications our recruiters may review or consider. #