Director, Product Security

CoreWeave•New York, NY

7d•$227,000 - $303,000

About The Position

CoreWeave is seeking a highly technical Director of Product Security to lead the company’s Product Security organization. The team is responsible for application security, vulnerability management, offensive security, AI product security, and product vulnerability response, partnering closely with Product, Engineering, and Security Foundations. The director will define the organization’s strategy and roadmap, lead managers and senior engineers, grow the organization, and build capabilities that do not yet exist. The role focuses on building an agentic-first security program that uses agents to discover, triage, test, and remediate vulnerabilities at scale, while people set policy and make consequential decisions. The director will establish a secure development lifecycle and a practical “paved road” for engineers, make security useful within existing engineering workflows, and ensure CoreWeave’s AI products and AI development tools are secure. The position also owns vulnerability management end to end, oversees a tiered offensive security program, and establishes product vulnerability response across the product portfolio. The director will integrate existing teams, hire managers, and work across Product Management, Cloud Security, Platform Security, Detection and Response, and GRC. Platform Security owns tenant-isolation controls and strategy; Product Security is responsible for testing that those controls hold. The role includes a standing leadership cadence with Product Management and authority for embedded Product Security Partners to make design-time security decisions within policy. The base salary range is $227,000 to $303,000. Compensation also includes a discretionary bonus, equity awards, and a comprehensive benefits program, subject to eligibility. The role requires access to export-controlled information, subject to the stated U.S. export-control eligibility requirements.

Requirements

10+ years of experience in security or software engineering, with significant experience in application security, vulnerability management, or offensive security.
5+ years of security leadership experience, including managing managers and scaling a multi-team organization.
Track record of building or running a product security program at a cloud provider, security company, or large-scale SaaS business.
Experience taking over existing teams and integrating them into one organization.
Track record of influencing engineering leaders on architecture and roadmap decisions outside the candidate’s direct ownership.
Strong bias for action, ability to move quickly, and ownership of outcomes.
Hands-on depth in modern application security, including the ability to assess threat models, review fixes, and distinguish actionable findings from noise.
Experience operating a vulnerability management program at scale, including metrics, SLAs, and executive reporting.
Direct offensive security experience, such as running a red team or penetration testing program or performing the work directly.
Working knowledge of how AI systems are built and deployed and of security issues involving LLMs, agents, and model supply chains.
Familiarity with Kubernetes, cloud infrastructure, and CI/CD sufficient to work credibly with engineers.
Experience building and mentoring diverse, inclusive, high-performing teams in a fast-paced environment.
Ability to lead through ambiguity and change, balance long-term platform investments with immediate fixes, and remain technically engaged by reading code, findings, and penetration-test reports.

Nice To Haves

Experience deploying AI agents or LLM-based tools for security work, or building the platform they run on.
Experience running a PSIRT or coordinated vulnerability disclosure function.
Experience with the security aspects of M&A diligence and integration.
Public contributions to the security community, such as open-source work, research, talks, or CVEs.

Responsibilities

Define and drive the Product Security strategy and roadmap across application security, vulnerability management, offensive security, AI product security, and product vulnerability response.
Lead and grow a multi-team organization of managers and senior individual contributors, including hiring engineering managers for each function.
Build an agentic-first vulnerability program in which agents discover, triage, and remediate issues at scale, with the goal of retiring classes of risk.
Own vulnerability management across CoreWeave’s infrastructure and products, including discovery, prioritization, SLAs, remediation, and executive reporting.
Run a tiered offensive security program combining continuous agentic testing, third-party assessments, internal testing of difficult targets, vulnerability disclosure, and bug bounty programs.
Conduct adversarial testing of models, agents, and the inference stack, including testing for prompt injection, poisoned tools, and abuse of autonomy.
Use offensive security to test tenant isolation across shared GPUs, bare metal, and Kubernetes, verifying controls owned by Platform Security.
Build a paved road for engineers using secure defaults, controls integrated into existing tools, and validated findings delivered with fixes.
Establish a secure development lifecycle across the business, including threat modeling, secure design review, CI/CD security tooling, and extension to acquired companies.
Own security for CoreWeave’s AI products and engineers’ AI tooling, including model and dataset supply chains, agent tooling, and provenance of AI-generated code.
Establish and run product vulnerability response (PSIRT), including intake, coordinated disclosure, customer communication, and fixes across the product portfolio.
Embed Product Security Partners in critical product areas with authority to make design-time security decisions within policy, and maintain a leadership cadence with Product Management.
Partner with Cloud Security, Platform Security, Detection and Response, and GRC to define clear boundaries and handoffs.