Product Security Engineer

Product Security EngineerJob type: Full Time · Department: Engineering · Work type: On-SiteChennai, Tamil Nadu, India Job detailsApplication formAbout RocketlaneRocketlane is a B2B SaaS platform for client onboarding and project delivery, and we're building Nitro, our AI-native product layer. We're looking for a Product Security Engineer to own product and infrastructure security for the company.What you'll ownThis is a hands-on, individual-contributor security role covering the full range of product security work, not just one slice of it.Offensive security and vulnerability discoveryRun internal penetration tests across our web app, APIs, mobile app, and cloud infrastructure, and triage findings from external pentest vendorsActively hunt for vulnerabilities in new features, including in AI/LLM-powered surfaces (prompt injection paths, unsafe code execution in agent tooling, unauthenticated internal endpoints)Have found and driven the fix for real vulnerabilities before. We need someone who thinks like an attacker, not just someone who runs a scanner and files a ticketCloud and infrastructure securityReview and harden our AWS setup: WAF rules, ALB/CloudFront TLS policies and cipher suites, container isolation, IAM and secrets hygieneInvestigate and close out Dependabot and other CI/CD security alerts across dozens of repos, and work with engineering teams to get fixes prioritized and shippedBuild and maintain internal security toolingCompliance and customer trustHelp with our compliance audit cycles end to end: evidence collection, control testing, and coordinating with auditors. This typically takes up 5% of the work.Respond to customer security questionnaires and InfoSec review requests, working with sales and customer success to turn these around quickly and accuratelyKeep our security documentation and posture current as the product and infrastructure evolveCross-team coordinationWork directly with engineering, platform, and ops teams to get security fixes prioritized and shipped, not just loggedReport critical findings up to leadership with clear, actionable writeups (source, sink, impact, fix)What we're looking for3+ years in a hands-on security role covering penetration testing and vulnerability research, ideally across web, API, mobile, and cloudReal, demonstrable experience finding and helping fix serious vulnerabilities (RCE, auth bypass, injection classes), not just running automated scansSolid working knowledge of AWS security: WAF, ALB/CloudFront, IAM, container security on ECS or similarComfort integrating security tooling into CI/CD pipelines (SAST/DAST, dependency scanning) and driving remediation with engineering teamsExperience with, or strong interest in, securing LLM/AI-powered applications: unsafe code execution, prompt injection, agent tool-call boundariesStrong written communication. You'll be writing up findings for engineers and explaining risk to non-technical stakeholders in the same weekNice to haveExperience building or maintaining internal security scanning toolsFamiliarity with Java/Spring Boot stacks (our backend) or Python (our AI/LLM stack)A CTF background, bug bounty track record, or security certifications (OSCP, etc.)Prior exposure to SOC 2 or similar compliance frameworks and customer-facing security questionnaires would be a plusWhy this roleYou'd be the primary security engineer for a fast-moving product company actively shipping AI agent features, with direct access to leadership and real ownership over what gets fixed and when. Apply for this positionAutofill from resumeSave time by uploading your resume. (Only PDF or DOCX format supported)Upload fileLoading...Made with