Product Security Engineer

About Rocketlane Rocketlane is a B2B SaaS platform for client onboarding and project delivery, and we're building Nitro, our AI-native product layer. We're looking for a Product Security Engineer to own product and infrastructure security for the company.

What you'll own:

• This is a hands-on, individual-contributor security role covering the full range of product security work, not just one slice of it.

Offensive security and vulnerability discovery:

• Run internal penetration tests across our web app, APIs, mobile app, and cloud infrastructure, and triage findings from external pentest vendors.
• Actively hunt for vulnerabilities in new features, including in AI/LLM-powered surfaces (prompt injection paths, unsafe code execution in agent tooling, unauthenticated internal endpoints).
• Have found and driven the fix for real vulnerabilities before. We need someone who thinks like an attacker, not just someone who runs a scanner and files a ticket.

Cloud and infrastructure security:

• Review and harden our AWS setup: WAF rules, ALB/CloudFront TLS policies and cipher suites, container isolation, IAM, and secrets hygiene.
• Investigate and close out Dependabot and other CI/CD security alerts across dozens of repos, and work with engineering teams to get fixes prioritized and shipped.
• Build and maintain internal security tooling.

Compliance and customer trust:

• Help with our compliance audit cycles end to end: evidence collection, control testing, and coordinating with auditors. This typically takes up 5% of the work.
• Respond to customer security questionnaires and InfoSec review requests, working with sales and customer success to turn these around quickly and accurately.
• Keep our security documentation and posture current as the product and infrastructure evolve.

Cross-team coordination:

• Work directly with engineering, platform, and ops teams to get security fixes prioritized and shipped, not just logged.
• Report critical findings up to leadership with clear, actionable write-ups (source, sink, impact, fix).

What we're looking for:

• 3+ years in a hands-on security role covering penetration testing and vulnerability research, ideally across web, API, mobile, and cloud.
• Real, demonstrable experience finding and helping fix serious vulnerabilities (RCE, auth bypass, injection classes), not just running automated scans.
• Solid working knowledge of AWS security: WAF, ALB/CloudFront, IAM, container security on ECS or similar.
• Comfort integrating security tooling into CI/CD pipelines (SAST/DAST, dependency scanning) and driving remediation with engineering teams.
• Experience with, or strong interest in, securing LLM/AI-powered applications: unsafe code execution, prompt injection, agent tool-call boundaries.
• Strong written communication. You'll be writing up findings for engineers and explaining risk to non-technical stakeholders in the same week.

Nice to have:

• Experience building or maintaining internal security scanning tools.
• Familiarity with Java/Spring Boot stacks (our backend) or Python (our AI/LLM stack).
• A CTF background, bug bounty track record, or security certifications (OSCP, etc.).
• Prior exposure to SOC 2 or similar compliance frameworks and customer-facing security questionnaires would be a plus.

Why this role:

You'd be the primary security engineer for a fast-moving product company actively shipping AI agent features, with direct access to leadership and real ownership over what gets fixed and when.