SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Obsidian Security, a unicorn cybersecurity company ($1.1B valuation, Series D funded with $85M in August 2026), is hiring a Product Security Engineer to strengthen security across its SaaS platform, cloud infrastructure, and AI/agent systems. The company protects enterprise SaaS estates and non-human identities for Fortune 500 clients including T-Mobile, Workday, and Snowflake, and is now deepening R&D in agentic AI security.
This is a hands-on engineering role spanning the full product lifecycle from architecture through production operations. You will design and build security features into backend services and cloud-native infrastructure—not just review them. Key responsibilities include:
• Building security features into products, backend services, and cloud infrastructure (authentication, authorization, service-to-service identity, tenant isolation, secrets management, audit logging)
• Securing customer data across its full lifecycle (collection, processing, storage, presentation) with encryption, key management, tenant isolation, access control, and retention policies
• Designing and securing cloud-native services on AWS and GCP (IAM, networking, storage, Kubernetes, managed services) with secure defaults and infrastructure-as-code
• Conducting security architecture and design reviews for new products, services, APIs, data pipelines, and infrastructure—including AI and agent systems
• Securing AI and agent workflows in product development and translating findings into concrete guardrails in code (least-privilege tool access, input/output controls, data-leakage protections)
• Strengthening CI/CD pipelines with automated security controls (dependency scanning, static analysis, container scanning)
• Leading CVE management (exposure analysis, risk assessment, prioritization, remediation, testing, deployment, validation) and automating where possible
• Conducting code reviews and mentoring engineers on secure development practices
The role is ideal for a senior engineer who combines deep product security expertise with strong software engineering fundamentals and hands-on cloud platform experience.
REQUIREMENTS:
• Solid experience in product security or related discipline, with a track record of shipping security improvements as code
• Deep knowledge of secure software development and common application security risks
• Strong software engineering skills in Python, Go, Java, Kotlin, TypeScript, or comparable languages
• Hands-on experience developing and securing applications on cloud-native services (AWS and/or GCP)
• Experience securing cloud-native SaaS products, distributed systems, APIs, and microservices, including protecting sensitive data end-to-end
• Practical CVE management experience across dependencies and infrastructure
• Strong English communication skills and ability to collaborate across regions and time zones
NICE-TO-HAVE:
• Experience securing AI/LLM applications or agent systems (OWASP Top 10 for LLM Applications, MCP/tool-permission models)
• Cybersecurity or identity security product experience
• Software supply chain security knowledge
• Familiarity with OWASP, CVSS, and NIST standards
• Experience with compliance frameworks (SOC 2, ISO 27001)
• Penetration testing or vulnerability research background
• Mandarin proficiency
