Senior Product Security Engineer
Endor Labs2 months ago
Bengaluru, IndiaSenior
Responsibilities
- Own software supply chain security, including risks from open-source packages, third-party binaries, container base images, build tools, and software dependencies.
- Own first-party software security, including code and container scanning, automated security testing, external penetration tests, and software integrity and provenance.
- Harden AI agents by enforcing least-privilege access across MCP, credentials, filesystem, and network resources while maintaining visibility into agent inventory and activity.
- Own and operate the responsible disclosure program, including triaging external reports and scaling the review process.
- Partner with engineering teams on security design reviews, secure architectures, and security best practices.
- Build and evolve Endor Labs’ application security program as one of its earliest dedicated security team members.
Requirements
- At least 5 years of application security or product security experience is required.
- At least 2 years of experience working with the security implications of agentic software development is required.
- Strong experience with threat modeling and secure architecture design is required.
- Practical experience securing build systems and CI/CD pipelines at scale is required; Bazel monorepo experience is a strong plus.
- Hands-on experience running end-to-end penetration tests and triaging bug bounty or responsible disclosure submissions is required.
- Ability to investigate, understand, and remediate security issues is required.
- Ability to work in ambiguous, fast-moving environments and define priorities without an established playbook is required.
- An attacker mindset, deep investigative ability, and strong collaboration and communication skills are expected.
- Willingness to use Endor Labs’ security platform as a customer zero and influence its product roadmap is expected.
About Endor Labs
Endor Labs builds an application security platform that maps code and dependencies to prioritize and remediate risks across the SDLC for AppSec and engineering teams. It supports SCA, SAST, container scanning, and software supply chain controls, including code produced by humans or AI. Founded in 2021 and headquartered in Palo Alto, it is privately held and sells to enterprises through multi-stakeholder security and engineering buyers.