Senior Security Engineer, Product Security (AI)

Location: United States. The role is associated with hirify.global's hybrid work model; some roles can be performed from anywhere in the country, while others are hub-based.

Annual base pay: $200,000–$245,000 USD in the San Francisco Bay Area and New York City; $174,000–$215,000 USD in all other US locations.

Company

hirify.global builds healthcare software applications on its Healthcare Map, combining de-identified real-world patient data with algorithms and clinical expertise to generate insights across the healthcare ecosystem.

What you will do

• Own the application security toolchain, including SAST, SCA, container and secret scanning, and DAST; configure tools, develop custom rules, and reduce false positives.
• Build security automation with Python or TypeScript and GitHub Actions, including policy-as-code checks, automated triage, and fix pull requests.
• Conduct threat modeling, secure design reviews, and high-risk pull-request reviews for services and AI features.
• Partner with Engineering and Forward Deployed Engineering on product security, customer deployments, security reviews, remediation, and secure lifecycle practices.
• Scope penetration tests, validate findings, verify fixes, and improve vulnerability intake, prioritization, and remediation metrics.
• Evaluate AI security tooling, coach engineers on secure LLM, LLM Gateway, MCP, RAG, and agent patterns, maintain SOC 2 controls, and participate in the security on-call rotation.

Requirements

• 6+ years of software or security engineering experience, including 3+ years in application or product security, with production code shipped in Python, TypeScript, Go, or Java.
• Hands-on experience with GitHub Actions at scale, including reusable workflows, OIDC, secrets, and self-hosted runners.
• Understanding of pipeline attacks such as poisoned pipeline execution, dependency confusion, and compromised actions, plus defenses including pinning, SBOMs, artifact signing, and SLSA.
• Experience running SAST and SCA programs across many repositories, writing custom rules, and prioritizing findings by reachability and exploitability.
• Hands-on web application and API penetration testing, authenticated DAST, and judgment to confirm or dismiss findings; fluency with the OWASP Top 10 and API Security Top 10.
• Hands-on security experience with LLM applications or agents, including protection against prompt injection, data leakage, insecure output handling, and excessive agency; daily use of AI coding assistants.
• Structured threat modeling and secure design review experience using methods such as STRIDE and AI-focused frameworks such as MAESTRO.
• Hands-on cloud security experience in at least one of AWS, GCP, or Azure, covering identity and access, network controls, containers, and infrastructure as code.
• Experience embedding with engineering teams, shipping fixes in their codebases, influencing without authority, explaining risk in business terms, documenting clearly, and owning outcomes end to end.

Nice to have

• Experience building or operating AI agents for security work, AI runtime protection, or LLM gateway products.
• Bug bounty experience, published CVEs, security talks, or open-source security tools.
• SOC 2 experience with SDLC and vulnerability management controls, or detection engineering for application-layer threats in a SIEM.
• Healthcare or data platform experience; forward-deployed or customer-facing security work in customer-owned cloud accounts and enterprise security reviews.
• Multi-cloud experience across AWS, GCP, and Azure.
• Application security certifications such as OSWE or GWAPT, or AWS, GCP, or Azure security certifications; certifications do not replace hands-on experience.

Culture & Benefits

• Hybrid work model with hubs in San Francisco, New York City, and Chicago; expectations vary by role and are communicated before joining.
• Flexible time off, holidays, comprehensive health, dental, and vision insurance, disability and life insurance, and applicable leaves of absence.
• 401(k) with company match and potential eligibility for performance-based bonuses and equity awards.
• AI is expected to be integrated into daily work, including workflow automation and document summarization.
• Participation in a security on-call rotation is required.

Hiring process

• Applicants acknowledge hirify.global's Privacy Notice for Employees and Contractors when submitting an application.