Staff Product Security Engineer

Tools for Humanity•San Francisco, CA

2d•$293,000 - $325,000

About The Position

As a hands-on technical leader, the Staff Product Security Engineer safeguards the products and services that power the World project. The role proactively embeds security throughout the development lifecycle and applies first-principles thinking to novel security challenges at global scale, helping protect users and preserve the integrity of the World protocol. The Security team builds trusted infrastructure for a global identity and financial network. Its work spans Orb hardware security, advanced cryptography, and the security of distributed cloud and mobile systems, with a focus on scaling securely while protecting privacy.

Requirements

At least 6 years of hands-on experience in Product Security or Application Security.
Experience building and operating AI-agent-based security automation pipelines for vulnerability detection and triage, code review, and remediation.
Proficiency in code review and development with languages such as Rust, Go, and Python.
Extensive experience securing modern AWS architectures and developing secure infrastructure as code, such as Terraform and CDK.
Ability to assess exploitability, prioritize security risks, and explain practical tradeoffs to engineering teams.
Strong background implementing and managing security tooling, including SAST, DAST, and SCA, and embedding security into CI/CD pipelines.
Deep understanding of web and API security principles, including OWASP Top 10, and experience securing distributed, mobile-first systems.

Nice To Haves

Particular interest in securing mobile applications or smart contracts.

Responsibilities

Lead secure architecture reviews and threat modeling sessions for new applications and services.
Build and operate AI-agent-based security automation pipelines for vulnerability detection and triage, code review, and remediation.
Develop automated security guardrails, reusable tools, and libraries that make secure development easier.
Conduct in-depth security code and infrastructure reviews, including in Rust, Go, and Python.
Own vulnerability management, from triaging bug bounty submissions to driving remediation with engineering teams.
Mature and scale the Secure SDLC and bug bounty programs to support a growing engineering organization.