Product Security Engineer

Eden Prescott is an innovative company focused on developing autonomous agents and multi-agent systems. They are seeking a Staff or Principal Security Engineer to build and scale the security program for their AI lab, defining security architecture and ensuring safe practices across various systems and products.

Responsibilities:

• Serve as the principal AppSec authority across engineering, advising on secure design, threat modeling, and code-level risks across agentic products, orchestration layers, internal tooling, and APIs
• Build security frameworks for agentic systems, including tool permission boundaries, prompt/input hardening, memory access controls, secrets handling, secure action execution, agent identity controls, and protections against unsafe or unintended agent behavior
• Design and implement security controls in CI/CD and the software supply chain, including dependency governance, artifact integrity, code signing, model and agent provenance controls, and protections against tampering or supply chain attacks
• Partner closely with founders and engineering leadership to design secure application and cloud practices across the stack
• Lead security reviews across agent runtimes, backend services, model-serving systems, retrieval pipelines, developer platforms, and customer-facing applications
• Develop tooling and automation to continuously detect vulnerabilities across codebases, agent workflows, third-party tools, and model-integrated systems
• Own and evolve AppSec incident response, covering vulnerabilities, prompt injection paths, insecure tool use, secrets exposure, agent misuse scenarios, and application-layer security events
• Establish and lead a security champions program, helping embed a culture of proactive security ownership in a fast-moving AI lab

Requirements:

• Strong expertise across the full SDLC, including secure design, code analysis, threat modeling, dependency hygiene, and deployment best practices
• Deep technical experience securing modern application stacks (Node.js, Go, Rust, Python, TypeScript), with the ability to go deep in code and understand vulnerabilities in depth
• Experience securing complex distributed systems, developer platforms, or highly dynamic product environments — ideally at high-growth startups or AI-native companies
• Strong understanding of modern supply chain risks, including package ecosystem threats, dependency manipulation, build pipeline integrity, and artifact verification
• Familiarity with emerging risks in agentic systems — prompt injection, unsafe tool execution, permission escalation, data leakage, agent abuse paths, and autonomous action risk
• Clear, concise communication skills, with the ability to influence founders and engineering leaders through pragmatic execution
• A builder's mindset — comfortable operating in ambiguity, setting foundations from scratch, and enabling developers to ship secure, high-impact systems quickly