Security Engineer, Product

Rogo•New York, NY

2d•$270,000 - $330,000

About The Position

Rogo is hiring a hands-on offensive security practitioner to protect its AI-driven platform. The Security Engineer will conduct penetration testing, red team exercises, and adversarial security assessments across applications, APIs, AI/ML pipelines, and cloud infrastructure, then translate findings into engineering changes that strengthen the product. The role focuses on building automated and agentic security tooling, integrating continuous security validation into engineering workflows, and contributing directly to backend code and security primitives. The engineer will also collaborate with engineering, infrastructure, product, and leadership teams; lead purple team exercises; and manage external penetration testing relationships.

Requirements

Professional penetration testing experience across web applications, APIs, and cloud environments; AI/ML systems experience is desirable.
Experience writing exploits, not only running scanners.
Professional development experience in a strongly typed language such as Rust, Go, Java, or C++, alongside scripting languages such as Python or Bash.
Familiarity with Burp Suite, Nuclei, Semgrep, custom fuzzing frameworks, and developing custom tools.
Experience integrating automated security checks, including SCA, SAST, and DAST, into CI/CD pipelines and providing actionable developer feedback.
Familiarity with infrastructure automation such as Terraform and Kubernetes, and ability to identify misconfigurations and attack paths in AWS or GCP environments.
Clear communication and ability to collaborate with developers, product teams, and leadership.
Applied knowledge of threat modeling, cryptography fundamentals, and compliance frameworks such as SOC 2, ISO 27001/42001, and NIST CSF.
Autonomous, self-directed, collaborative, organized, thoughtful, and comfortable working in a fast-paced startup environment with ambiguity.

Nice To Haves

OSCP, OSWE, GXPN, GWAPT, CPTS, or similar offensive security certification.
Experience testing multi-tenant SaaS platforms serving regulated industries, particularly financial services.
Hands-on cloud penetration testing in AWS or GCP, including privilege escalation, cross-account attacks, or metadata abuse.
Kubernetes security testing experience, including RBAC abuse, container escapes, admission controller bypasses, or network policy evasion.
Bug bounty track record or published CVEs or security research.
Experience in customer-facing security conversations, technical deep dives, penetration test debriefs, and security architecture reviews.
Experience with AI/ML security assessments or building agentic security tooling.

Responsibilities

Conduct continuous penetration testing and red team assessments across applications, APIs, AI/ML pipelines, and cloud environments.
Build agentic security tooling to find, validate, and patch vulnerabilities across code review, dependency management, and infrastructure as code.
Develop and maintain custom offensive tools, exploit chains, and attack simulations tailored to Rogo's AI platform and architecture.
Build and operate automated security testing and remediation pipelines.
Test AI-specific attack surfaces, including prompt injection, model manipulation, data poisoning vectors, agent-based workflows, and tenant isolation boundaries.
Conduct vulnerability research and bug hunting to identify logic flaws, authorization bypasses, and chained exploits.
Design and run threat modeling sessions with engineering teams, translating findings into prioritized remediation.
Build attack simulation environments and continuously validate security controls against real-world tactics, techniques, and procedures and customer-driven penetration test scenarios.
Contribute to backend code, remediate critical vulnerabilities, harden authentication and authorization, and build security primitives into the platform.
Lead purple team exercises with infrastructure and engineering teams to test detection and response capabilities.
Manage relationships with external penetration testing firms and drive remediation of their findings to closure.
Share offensive tradecraft, emerging attack techniques, and lessons learned with engineering and leadership.