Product Security Engineer, North Security

Cohere is hiring a Senior Product Security Engineer to secure its AI-powered products and enterprise systems. The role works hands-on with product engineers to review architecture and code, threat model new capabilities, test vulnerabilities, and build reusable security guardrails.

Responsibilities:

• Lead security reviews. Review architecture, code, and security-sensitive changes. Identify both individual vulnerabilities and the recurring design patterns behind them
• Secure AI-powered products. Evaluate risks such as prompt injection, unsafe tool use, identity and delegation failures, excessive agency, data exposure, tenant isolation, and sandbox escapes
• Threat model new capabilities. Identify trust boundaries, abuse cases, and high-impact failure modes before implementation. Translate findings into practical, prioritized mitigations
• Perform hands-on testing. Investigate suspected vulnerabilities, develop proofs of concept, assess exploitability and impact, and partner with engineers through remediation
• Build scalable guardrails. Develop secure defaults, approved patterns, reusable controls, review requirements, and automated checks that reduce recurring risks
• Strengthen engineering capability. Pair with engineers, document practical guidance, and help product teams develop durable security expertise
• Influence risk decisions. Explain technical findings, business impact, and remediation options clearly to engineers, product leaders, and executives

Requirements:

• You have strong software engineering fundamentals and can independently understand, test, and contribute fixes to production codebases
• You are proficient in at least one of Python, Go, or TypeScript
• You have led security reviews or threat models for complex production systems and can point to meaningful design or risk improvements that resulted
• You understand common vulnerability classes and their underlying design failures, including injection, authorization flaws, IDOR, SSRF, unsafe deserialization, race conditions, cryptographic misuse, and software supply-chain risks
• You understand modern application architecture, including web applications, APIs, OAuth/OIDC, cloud platforms, containers, Kubernetes, and CI/CD systems
• You can reason rigorously about untrusted input, authorization, isolation, identity, delegation, and data boundaries
• You have driven security improvements involving multiple engineering teams, including situations where influence mattered more than authority
• You communicate clearly with both technical and non-technical audiences
• Direct experience with agentic AI systems is valuable but not required
• Experience building or operating security tooling such as SAST, DAST, SCA, custom linters, or policy-as-code
• Experience securing multi-tenant SaaS, enterprise software, or systems that process sensitive customer data
• Offensive security experience through penetration testing, red teaming or security research
• Experience operating or participating in a vulnerability disclosure or bug bounty program
• Contributions to open-source security projects, published research, conference talks, or credited vulnerability discoveries