Product Security Engineer

About the role

You will be our first dedicated security engineer, accountable for three questions: is this system safe to hand a customer's revenue data to, would we know if it wasn't, and can we prove it to an auditor or enterprise buyer without inventing anything? It's a hands-on individual contributor role. Your Manager reviews your work.

What you'll do

• Threat-model new features before code exists: webhooks, integrations, AI agents acting on customer data
• Find real, exploitable bugs in our code (authorisation, IDOR, injection, SSRF, races on money paths), prove them, and fix the class of bug
• Treat tenant isolation as a property of the system and build ways to prove it holds
• Tighten AWS IAM, network, secrets and CI/CD, with guardrails so the same issue can't ship again
• Own identity and access: sessions, tokens, SSO and SCIM, API keys, and the credentials we hold for customers

What you need

• 3–6 yrs of experience
• ISO 27001
• AWS
• IAM
• CI/CD
• Data privacy
• Customer success
• Any graduate