Product Security Engineer

Airtable is a no-code app platform that empowers organizations to transform how work gets done. As a Product Security Engineer, you will play a pivotal role in shaping the security of Airtable’s platform, partnering closely with engineering teams to build frameworks and automated controls to ensure secure coding practices.

Responsibilities:

• Develop self-service security frameworks and "paved roads" that allow engineering teams to ship secure code by default
• Focus on automated guardrails for common vulnerabilities, while prioritizing deep-dive design reviews into complex business logic and data isolation issues (for example, multi-tenant isolation and authorization/permission bypasses) that automated tools cannot catch
• Partner with product and engineering teams to review designs early, contribute to threat modeling for new features and complex initiatives, and provide clear, actionable security guidance
• Research emerging threats and evolving best practices, specifically regarding AI and LLM safety, and implement controls to secure these workflows
• Manage and evolve our approach to external penetration testing and bug bounties, driving remediation for findings and treating vulnerability management as an engineering problem
• Contribute to the long-term roadmaps, metrics, and strategic planning for the security team
• Lead complex threat modeling sessions for major product launches and define secure coding standards, and actively mentor other engineers to raise the technical security bar across the organization

Requirements:

• 4+ years of experience in product security or application security, with experience shipping production code
• Strong background in computer science or a related field, with proficiency in writing clean, maintainable code
• Deep familiarity with JavaScript or TypeScript, Node.js, and modern web application frameworks, and can reason about the security implications of systems built on them
• Hands-on experience securing LLM integrations and identifying prompt injection or data leakage risks
• Proficient in writing and reviewing code and treat security as an engineering problem to be solved with software, not just policies
• Excel at communicating complex security risks to non-security stakeholders and enjoy collaborating cross-functionally to find solutions that balance security with engineering velocity
• Comfortable working in a fast-paced environment, navigating ambiguity, continuously learning about emerging threats and technologies, and contributing to long-term security strategy