Senior Security Engineer - Product

Senior Security Engineer - Product Security

Ridgeline is looking for an experienced Product Security Engineer to join our growing Security Engineering team and help us build security into the products our clients rely on. As a Senior Security Engineer at Ridgeline, you will partner with product and engineering teams to identify and solve security problems in our multi-tenant investment management platform, from early design through production.

This is a hands‑on role, ideal for someone who enjoys going deep on how products work, finding the ways they can break, and shipping fixes, guardrails, and automated systems alongside the engineers who own them. You’ll be the security partner for key product areas, helping teams make sound security decisions without slowing them down.

Ridgeline places a strategic emphasis on the responsible and innovative use of AI, integrating it deeply into our platform, internal tools, and engineering processes. A core part of this role is building AI-driven systems that let a small security team cover a large, fast‑moving product surface: automating security review, triage, and remediation so every product team gets security support, not just the ones we can reach in person. You will also help secure the AI‑powered features we ship to clients, including LLM integrations, agents, and retrieval pipelines.

What will you do?

• Perform security code reviews and hands‑on testing of product features, with a focus on authentication, authorization, tenant isolation, and handling of sensitive financial data.
• Own the product vulnerability lifecycle: triage findings from scanners, penetration tests, assess real‑world impact, and drive remediation with engineering teams.
• Build and improve secure‑by‑default libraries, frameworks, and guardrails that make the secure path the easy path for product engineers.
• Design, build, and operate AI‑driven systems, such as LLM‑ and agent‑based pipelines for security code review, threat modeling, vulnerability triage, and remediation, that scale product security coverage across all engineering teams.
• Measure the quality of these systems with clear evaluations and feedback loops, and iterate until engineers trust their output.
• Assess the security of AI‑powered product features, including prompt injection, data leakage, and model or tool misuse risks.
• Translate emerging threats and industry vulnerabilities into concrete improvements for Ridgeline’s products.
• Mentor engineers and lead secure coding education tailored to the product areas you support.
• Foster a collaborative environment rooted in learning, teaching, and trust.

Desired Skills and Experience:

• 5+ years of experience in product security, application security, or software engineering roles.
• Bachelor’s degree in Computer Science or a related discipline, or equivalent practical experience.
• Proficiency in one or more modern programming languages (e.g., Kotlin/Java, TypeScript, Python, Go), with the ability to read unfamiliar codebases and write fixes.
• Hands‑on experience running threat models and security design reviews for web applications, APIs, and distributed services.
• Strong understanding of authentication and authorization patterns (OAuth 2.0, OIDC, SAML, RBAC/ABAC) and how they fail in practice.
• In-depth understanding of common application and API vulnerabilities (OWASP Top 10, OWASP API Security Top 10, CWE) and practical mitigation strategies.
• Experience performing manual security testing and code review, and validating findings from automated tools.
• Clear, thoughtful communicator who can explain security risk and tradeoffs to engineers, product managers, and leadership.
• Strong sense of ownership, with a track record of driving security fixes to completion across teams.
• Experience working closely with product teams, balancing security requirements against delivery timelines and user experience.
• AI security fluency: can evaluate risks tied to LLM‑powered features, agents, embeddings, and third‑party model APIs.
• Experience building production software or automation that integrates LLMs or agents into real workflows, including prompt and tool design, evaluation, and handling of false positives and failure modes.

Nice to haves:

• Experience securing multi‑tenant SaaS platforms, ideally in financial services or another regulated industry.
• Familiarity with AWS, particularly around IAM, container services, Lambda, and related infrastructure.
• Experience running a bug bounty program or triaging findings from third‑party penetration tests.
• Experience with agent frameworks, retrieval pipelines, or LLM evaluation tooling, or a portfolio of AI‑driven security projects (open source, research, or internal tools).
• Security research, CVEs, bug bounty participation, open‑source contributions, or other community involvement.

Compensation and Benefits

The typical starting salary range for this role is: $149,500 - $224,500. Final compensation amounts are determined by multiple factors, including candidate experience and expertise, and may vary from the amount listed above.

As an employee at Ridgeline, you’ll have many opportunities for advancement in your career and can make a true impact on the product.

In addition to the base salary, Ridgeline employees can participate in our Company Stock Plan subject to the applicable Stock Option Agreement. We also offer rich benefits that reflect the kind of organization we want to be: one in which our employees feel valued and are inspired to bring their best selves to work. These include unlimited vacation, educational and wellness reimbursements, and $0 cost employee insurance plafis. Please check out our Careers page for a more comprehensive overview of our perks and benefits.

Ridgeline is building the next generation of investment management technology. Founded by Tech visionary Dave Duffield, Ridgeline delivers a modern, cloud‑native platform designed to transform how investment firms operate.

As AI reshapes the future of work, Ridgeline is investing deeply in enabling every employee - across technical, operational, and business functions - to adopt and leverage AI skillfully. We believe AI transformation is not simply about deploying tools; it’s about fundamentally evolving how organizations learn, operate, and make decisions.

To help lead that transformation, we’re building a new AI Enablement function focused on enterprise‑wide learning, workforce transformation, and organizational adoption.

Ridgeline is proud to be a community‑minded, discrimination‑free equal opportunity workplace.

Ridgeline processes the information you submit in connection with your application in accordance with the Ridgeline Candidate Privacy Policy . Please review the Ridgeline Candidate Privacy Policyin full to understand our privacy practices and contact us with any questions.

Voluntary Self‑Identification

For government reporting purposes, we ask candidates to respond to the below self‑identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in Ridgeline’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service‑connected disability.

A "recently separated veteran" means any veteran during the three‑year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Voluntary Self‑Identification of Disability

Form CC‑305

Page 1 of 1

OMB Control Number 1250‑0005

Expires 07/31/2029

Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at .

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

• Alcohol or other substance use disorder (not currently using drugs illegally)
• Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
• Blind or low vision
• Cancer (past or present)
• Cardiovascular or heart disease
• Celiac disease
• Cerebral palsy
• Deaf or serious difficulty hearing
• Diabetes
• Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
• Epilepsy or other seizure disorder
• Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
• Intellectual or developmental disability
• Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
• Missing limbs or partially missing limbs
• Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
• Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
• Neurodivergence, for example, attention‑deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
• Partial or complete paralysis (any cause)
• Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
• Short stature (dwarfism)
• Traumatic brain injury

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.