Director, Product Security

CoreWeave•Sunnyvale, NY

6d•$227,000 - $303,000

About The Position

CoreWeave is seeking a highly technical Director of Product Security to lead the company’s Product Security organization. The team is responsible for application security, vulnerability management, offensive security, AI product security, and product vulnerability response, partnering closely with Product, Engineering, and Security Foundations. The Director will own the organization’s strategy and roadmap, lead managers and senior engineers, and build new capabilities while making security a useful, integrated product for CoreWeave engineers. The role emphasizes an agentic-first approach to security: using agents to threat model changes, review work before it merges, discover and remediate vulnerabilities, and continuously test systems. The Director will build programs and systems that scale with CoreWeave’s expanding attack surface, while humans set policy and make consequential decisions. The position also includes security ownership for CoreWeave’s AI products and engineering AI tools, and responsibility for ensuring that security programs cover the company’s products and infrastructure. The Director will lead and grow a multi-team organization, including hiring managers, and will work across Product, Engineering, Cloud Security, Platform Security, Detection and Response, and GRC. The role calls for a hands-on technical leader who can guide architecture and roadmap decisions, lead through ambiguity, and build inclusive, high-performing teams.

Requirements

10+ years of experience in security or software engineering, with significant experience in application security, vulnerability management, or offensive security.
5+ years of security leadership experience, including managing managers and scaling a multi-team organization.
Track record of building or running a product security program at a cloud provider, security company, or large-scale SaaS business.
Experience taking over existing teams and integrating them into one organization.
Track record of influencing engineering leaders on architecture and roadmap decisions outside the candidate’s direct ownership.
Strong bias for action, scrappiness, and ownership of outcomes, including work not explicitly assigned.
Hands-on depth in modern application security, including ability to read threat models, review fixes, and distinguish real findings from noise.
Experience operating a vulnerability management program at scale, including metrics, SLAs, and executive reporting.
Direct offensive security experience, such as running a red team or penetration testing program or performing the work directly.
Working knowledge of how AI systems are built and deployed, including security issues involving LLMs, agents, and model supply chains.
Familiarity with Kubernetes, cloud infrastructure, and CI/CD sufficient to work credibly with the engineers who build them.
Experience building and mentoring diverse, inclusive, high-performing teams in a fast-paced environment.
Strong owner's mindset and continued technical engagement, including reading code, findings, and penetration test reports.

Nice To Haves

Experience deploying AI agents or LLM-based tooling for security work, or building the platform on which they run.
Experience running a PSIRT or coordinated vulnerability disclosure function.
Experience with the security aspects of M&A diligence and integration.
Public contributions to the security community, such as open source, research, talks, or CVEs.

Responsibilities

Define and drive the Product Security strategy and roadmap across application security, vulnerability management, offensive security, AI product security, and product vulnerability response.
Lead and grow a multi-team organization of managers and senior individual contributors, including hiring engineering managers for each function.
Build an agentic-first vulnerability program in which agents discover, triage, and remediate issues at scale, aiming to eliminate classes of risk rather than address tickets one at a time.
Own vulnerability management across CoreWeave’s infrastructure and products, including discovery, prioritization, SLAs, remediation, and executive reporting.
Run a tiered offensive security program combining continuous agentic testing, third-party assessments, an internal team focused on difficult targets, and external researchers through vulnerability disclosure and bug bounty programs.
Lead adversarial testing of models, agents, and the inference stack, including testing for prompt injection, poisoned tools, and abuse of autonomy.
Use offensive security to validate tenant isolation across shared GPUs, bare metal, and Kubernetes; Platform Security owns isolation controls and strategy, while Product Security verifies they hold.
Build a paved road for CoreWeave engineers through secure defaults, controls integrated into existing engineering tools, and validated findings accompanied by fixes.
Establish a secure development lifecycle across the business, including threat modeling, secure design review, and security tooling in CI/CD; extend it to acquired companies.
Own security for CoreWeave’s AI products and the AI tools engineers build with, including model and dataset supply chains, agent tooling, and provenance of AI-generated code.
Establish and run product vulnerability response (PSIRT), covering intake, coordinated disclosure, customer communication, and fixes across the product portfolio.
Embed Product Security Partners in critical product areas with authority to make design-time security decisions within policy, and maintain a regular leadership cadence with Product Management.
Partner with Cloud Security, Platform Security, Detection and Response, and GRC to clarify prevention, detection, and response boundaries and ensure clean handoffs.
Build and mentor diverse, inclusive, high-performing teams.

Benefits

Discretionary bonus and equity awards, subject to eligibility.
Medical, dental, and vision insurance, 100% paid by CoreWeave for US-based full-time employees.
Company-paid life insurance.
Voluntary supplemental life insurance.
Short- and long-term disability insurance.
Flexible Spending Account.
Health Savings Account.
Tuition reimbursement.
Ability to participate in the Employee Stock Purchase Program (ESPP).
Mental wellness benefits through Spring Health.
Family-forming support through Carrot.
Paid parental leave.
Flexible, full-service childcare support through Kinside.
401(k) with a generous employer match.
Flexible PTO.
Catered lunch each day at office and data center locations.
Casual work environment.
For roles outside the US, benefits vary and are shared during the hiring process.