SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Anyscale is building the commercial platform around Ray, an open-source distributed computing framework used by OpenAI, Uber, Spotify, Instacart, Cruise, and others to power AI and ML workloads at scale. The company has raised $250M+ from top-tier investors including Andreessen Horowitz and NEA.
As Senior Product Security Engineer, you will own Anyscale's secure software development lifecycle (SSDL) and serve as engineering's security partner. Reporting to the Head of Security, this is a high-ownership role with significant scope and autonomy.
Key responsibilities:
- Design and operate a scalable SSDL that enables rather than gates engineering velocity, including threat modeling, security requirements definition, secure design practices, and developer-friendly scanning.
- Partner with engineering teams on security features and secure-by-design architecture from early design through implementation.
- Conduct security reviews of existing systems and new initiatives, translating findings into prioritized, actionable work.
- Own vulnerability management end-to-end: enumerate software components, map known vulnerabilities, produce accurate posture reporting on demand, and drive resolution against defined SLAs.
- Establish and operate software composition analysis, secret scanning, and SAST tooling across product repositories.
- Mentor engineers and raise the security bar across the organization.
In your first year, success means an SSDL that scales with engineering growth, security review embedded in new initiative workflows, and accurate, on-demand vulnerability reporting with clear resolution paths.
Requirements:
- 8+ years in product or application security with senior-level depth, ideally at a high-growth startup.
- Demonstrated ownership of a secure software development lifecycle at scale, including threat modeling and secure design review.
- Strong hands-on background partnering with engineering on security features and architecture, not just reporting findings.
- Deep experience with software composition analysis, secret scanning, SAST, and secure-development tooling in real repositories.
- Solid understanding of software supply chain security, component enumeration, and SBOM approaches.
- Experience triaging vulnerabilities using CVSS and business context, driving resolution with engineering teams.
- Communication skills and seniority to set direction, review others' work, and elevate security practices.
Nice to have:
- Experience producing vulnerability or security posture reporting for enterprise or regulated customers.
- Familiarity with container artifact security (image scanning, signing, SBOM generation).
- Experience building or maturing an SSDL program at scale.
- Background in AI/ML platforms or distributed systems.
About Anyscale
AI / Data / Infrastructure — distributed computing and AI workload platform built around Ray.
