SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Endor Labs is building an AI-driven application security platform that helps enterprises secure code at scale. The company's patented code context graph identifies which vulnerabilities can actually be exploited and delivers fixes that won't break applications. Founded by Varun Badhwar (who built Prisma Cloud to $300M ARR), Endor Labs has raised $163M from top-tier investors including Lightspeed, Coatue, and Salesforce Ventures.
As the founding Staff Product Security Engineer, you will work closely with the Head of Security & IT to set and execute the security strategy for the Endor Labs platform. This is a rare opportunity to run application security for an application security company—your internal security program will serve as both a proving ground for the product and an incubator for R&D.
Key responsibilities include:
• Fixing issues in the application: AI tooling generates findings at scale; your focus will be on validating, prioritizing, and fixing findings on an ongoing basis—work that directly informs the platform built for customers.
• Preventing insecure code from being merged: Build out the internal apparatus around Endor Labs' own AI SAST product and establish paved paths so all engineers can be confident in the security of their code contributions.
• Shaping the product: Work closely with Product and Engineering to solve customer problems, review designs, influence the roadmap, and share learnings with customers, prospects, and the security community.
• Threat modeling and secure architecture: Leverage deep threat modeling skills to guide AI-driven scanning efforts and design reviews across supply chain security, first-party code scanning, runtime monitoring, and AI agent hardening.
You'll operate in an ambiguous, fast-moving environment where you set direction and influence senior stakeholders without formal authority. This role requires hands-on technical work, a fix-it mindset, and the ability to measure whether security tooling and automation actually work at scale.
REQUIREMENTS:
• 10+ years in application or product security, including staff- or principal-level technical leadership
• Track record of building security tooling and automation that runs at scale across an engineering organization, with demonstrated measurement of effectiveness
• Track record of influencing a product or platform roadmap—turning internal security work into something other teams or customers adopt
• Demonstrated hands-on work applying LLMs and agents to security problems; well-reasoned opinions on both finding/validating/fixing vulnerabilities in existing code and preventing insecure code from being merged
• Deep threat modeling and secure architecture skills
• Ability to set direction and influence senior engineering, product, and customer stakeholders without formal authority
• Fix-it mindset: investigate, find root causes, and drive remediation rather than just reporting
• Comfort building from scratch in ambiguous, fast-moving environments and setting priorities without an established playbook
NICE-TO-HAVES:
• Experience securing build systems and CI/CD at scale, especially Bazel monorepos
• Background in security research (vulnerability research, program analysis, static analysis tooling)
• Conference talks, publications, or open-source work in application security
