Product Security Engineering

Product Security Engineer
Engineering
Full-time
BackOps AI transforms supply-chain operations with agentic AI that automates complex workflows, freeing teams to focus on what matters most. Headquartered in the San Francisco Bay Area, we foster a culture of innovation, ownership, and measurable impact.
Our agents take real actions inside our customers' live operations. You will read the code, write the fix, and ship guardrails that engineers keep switched on because they are fast and mostly right.
In this role, you will own the security of the BackOps product end to end, and set the bar for how secure software gets built here while the company triples in size.

Own product security end to end: authentication, authorization, multi-tenant isolation, APIs, and the data model behind them.
Threat model the agent platform. Define what an agent is allowed to do in a customer's systems, prove the boundary holds, and design what happens when an agent is asked to do something it should not.
Build the secure development lifecycle: design review, code review standards, and scanning in CI with a triage path engineers actually use.
Run application vulnerability management end to end. Set the security bar for AI-assisted code. A large share of our code is written with coding agents, and human ownership of what merges is not optional.
Secure the software supply chain: dependencies, build pipeline, artifacts, and third-party integrations.
Own the engineering side of enterprise security reviews, penetration tests, and coordinated vulnerability disclosure, so customer scrutiny stops being a fire drill.
Extend the same controls to customer-hosted and on-prem deployments, where they have to hold up without our infrastructure around them.
5+ years in product or application security engineering, or a software engineer who moved into security and stayed hands-on.

• Strong coding skills in Python, Go, TypeScript, or similar. OAuth and OIDC, RBAC, token and session handling, and the access-control bugs that only show up between two features.
• Web and API security depth across the OWASP Top 10 classes: injection, SSRF, deserialization, and broken access control, and how these actually get exploited rather than how they are listed.
• Working familiarity with the OWASP Top 10 for Agentic Applications and the OWASP Top 10 for LLM Applications. Threat modeling that produces engineering work with owners and dates, not a document.
• Hands-on with SAST, DAST, SCA, and secrets scanning in CI, including keeping the noise low enough that teams do not turn the checks off.
• Judgment about risk. Clear written and verbal communication with engineers, executives, and customers, including saying plainly what is still unknown.
• Comfortable defining the structure while doing the work, in a company where requirements change week to week.

Enterprise security reviews and customer questionnaires answered from the engineering seat.
Multi-tenant B2B SaaS, and on-prem or customer-hosted deployment.
What an agent can do inside a customer's systems is bounded by design, and we can demonstrate the boundary holds.
Teams ship secure features without you in the room.
Own product security at an AI-native company while the product is still being shaped.
Our agents take real actions in customer operations, which makes this work matter more here than it does in most places.
Small team with real autonomy and direct access to founders and customers.
Competitive salary and meaningful equity.

• Comprehensive health, dental, and vision coverage.
• 401(k) plan, disability insurance, and life insurance.
• Flexible time off.
• Daily meals in the office, and regular team events and offsites.

#