Senior Product Security Engineer

Lambda•San Francisco, CA

2d•$266,000 - $395,000•Hybrid

About The Position

Lambda is hiring a Senior Security Engineer on its Product Security team to help secure the infrastructure and software Lambda sells, including data-center network and cluster infrastructure and customer-facing software. The role reports to the Senior Manager of Security and partners with Product Engineering, Data Center Operations and Engineering, Detection & Response, and GRC. The engineer will own security outcomes for an area of the product, bringing depth in either infrastructure security or application security while contributing across both. The work includes threat modeling and reviewing designs for new products and data centers, protecting customer workload isolation, operating risk-driven vulnerability management, supporting customer security reviews, and building security tooling. The role also uses LLMs hosted on Lambda infrastructure, frontier models, and AI tools to extend code and design review. Lambda seeks an engineer who builds security into systems alongside the teams that own them.

Requirements

At least 5 years of demonstrated security engineering experience, either directly as a security engineer or as a software, infrastructure, or site reliability engineer driving security outcomes; equivalent formal security training combined with strong engineering experience is also welcomed.
Demonstrated depth in infrastructure security or application security, including design reviews, threat models, or fixes adopted by engineering teams.
Ability to independently own security work end to end, make sound decisions, and recognize when to escalate.
Ability to thrive in fast-paced, ambiguous startup environments where priorities shift and structure must be built while executing.
Strong hands-on Linux experience in bare-metal and cloud environments, with understanding from kernel through application layers.
Fluency in reading application code and infrastructure as code, such as Terraform, Ansible, and Kubernetes manifests, sufficient to explain vulnerability root causes.
Experience shipping production-grade tooling in Python, Go, or a similar language.
Ability to translate security risk into business impact for engineers, leadership, and customers.
Excellent collaboration skills with technical teams, with or without formal authority.

Nice To Haves

Deep code-analysis expertise, such as source-code auditing, fuzzing, reverse engineering, or vulnerability research with published findings or CVEs.
Experience securing multi-tenant infrastructure, including network segmentation, virtualization or container isolation, Kubernetes, hardware root of trust, or secure boot.
Experience leading security assessment and requirements for a major platform component or enterprise system.
Experience building infrastructure-as-code security guardrails, such as policy-as-code checks in CI/CD or secure-by-default modules.
Experience running vulnerability management as a program with risk-based prioritization and remediation SLAs.
Experience supporting enterprise customer security reviews or providing significant evidence for compliance audits such as SOC 2, ISO 27001, or FedRAMP.
Experience with AI/ML infrastructure security, model security, or protecting high-value computational workloads.
Significant experience operating large-scale production services, such as SRE across thousands of hosts, or virtualization at scale with KVM, Hyper-V, or Xen.
Enthusiasm for leveraging LLMs on Lambda infrastructure, frontier models, and AI tools for AI-assisted code review, automated threat modeling, and intelligent vulnerability triage.

Responsibilities

Own security design reviews and threat models for systems in the assigned area, providing actionable recommendations early in the design process.
Harden network, cluster, and infrastructure-service layers to keep customer workloads isolated.
Review application code and infrastructure as code, identify vulnerabilities through analysis and testing, and work with owning teams to implement fixes.
Operate vulnerability management as a risk-driven program by validating and prioritizing scanner findings and driving remediation to SLA with Technical Program Managers.
Develop security requirements, reference patterns, and guardrails based on recurring review findings.
Partner with GRC on customer security reviews and architecture discussions, providing technically grounded explanations of workload protections.
Build Python, Go, or similar automation to extend security review and triage coverage, including use of LLMs and AI tools.
Collaborate with Product Engineering, Data Center Operations and Engineering, and Detection & Response, including on bug bounty and vulnerability disclosure reports.
Coach engineers in supported teams on secure design and mentor newer security team members.
Balance strategic investments with tactical work and prioritize measurable progress.