Senior Product Security Engineer

About the role

This early, high‑ownership role will make you one of the first dedicated members of Endor Labs' Security team, responsible for securing the application from code to runtime. You will act as customer‑zero for the platform, shaping its roadmap while partnering closely with engineering and product teams.

Key responsibilities

• Own software supply‑chain security, defending against risks from open‑source packages, third‑party binaries, container base images, build tools and other dependencies.
• Own first‑party software security, including code and container scanning, automated security testing in CI, external penetration tests, and ensuring integrity and provenance of published artifacts.
• Harden AI agents by enforcing least‑privilege access across MCP, credentials, filesystem and network resources while maintaining visibility into agent inventory and activity.
• Run the responsible disclosure program, triaging external reports, maintaining quality standards and scaling the review process.
• Partner with engineering teams from concept through implementation to conduct security design reviews, define secure architectures and enforce best practices.
• Help shape and evolve Endor Labs’ application security program as one of its earliest dedicated security team members.

Required profile

• 5+ years of experience in application or product security with strong hands‑on fundamentals.
• At least 2 years working on security implications of agentic software development.
• Proven expertise in threat modeling and secure architecture design.
• Experience securing build systems and CI/CD pipelines at scale; Bazel monorepo experience is a plus.
• Hands‑on experience running end‑to‑end penetration tests and triaging bug‑bounty or responsible disclosure submissions.

Required skills

• Threat modeling
• Secure architecture design
• CI/CD pipeline security
• Bazel
• Penetration testing
• Bug bounty triage
• Software supply‑chain security
• Container security