Senior Product Security Engineer

Who We Are AI coding is the largest use case of enterprise AI adoption today, as is evident from the success of Anthropic on Claude Code, Cursor’s $60B exit to SpaceX, and Cognition’s $48B valuation. The bottleneck now has moved from code generation to security and safety - AI agents write code faster than any team can review it, and over 65% of the lines of code produced by them are insecure. Vulnerabilities are piling up 16x faster than companies can fix them, and adversaries are able to exploit these new vulnerabilities within hours. AURI by Endor Labs closes that gap. It runs inside the harness where coding agents work, through hooks, skills and MCP, so the controls sit outside the model and every agent action is visible. Underneath is our patented code context graph, which maps code, open source, containers and infrastructure. It shows which vulnerabilities can actually be reached and exploited, then delivers fixes that won’t break the application. Security teams get evidence instead of noise, and developers get fixes instead of tickets. The companies building AI trust us to secure it - our customers include OpenAI, SpaceX, DoorDash, Dropbox, Atlassian, MongoDB, Snowflake, Robinhood and Peloton to name a few. Endor Labs is the third company from Founder & CEO Varun Badhwar, who built Prisma Cloud, the platform that helped define cloud security, from $0 to $300M ARR at Palo Alto Networks. We’ve raised $163M from Lightspeed, Coatue, DFJ Growth, Salesforce Ventures and Dell Technologies Capital. Software runs everything around our lives today - banking, hospitals, airports and power grids. AI now writes more of it every day, and our mission is to make sure the world can trust that software. Come build that future with us. How You'll Make an Impact This is an early, high-ownership role where you'll be one of the first dedicated members of our Security team and own application security end to end. Your charter is to secure the Endor Labs application from code to artifact to runtime—including the agents driving our AI SDLC and our platform itself. As an Application Security company, you’ll also be customer zero of our product, using it firsthand and helping shape the roadmap in the process. You’ll partner closely with the Head of Security & IT, as well as our engineering and product teams. • Own software supply chain security, including defenses against risks from open-source packages, third-party binaries, container base images, build tools, and other software dependencies. • Own first-party software security, including code and container scanning, automated security testing in CI, external penetration tests, and the integrity and provenance of software we build and publish. • Harden our AI agents by enforcing least-privilege access across MCP, credentials, filesystem, and network resources, while maintaining visibility into agent inventory and activity. • Own and run the responsible disclosure program, including triaging external reports, maintaining submission quality standards, and scaling the review process. • Partner with engineering teams from concept through implementation to conduct security design reviews, define secure architectures, and ensure security best practices are followed. • Help shape and evolve Endor Labs’ application security program as one of its earliest dedicated security team members. What You Bring to the Table If you are excited about building an application security program from the ground up and enjoy working at the intersection of security, engineering, and AI, we would love to talk to you! • 5+ years of experience in application security or product security, with strong hands-on experience across application security fundamentals. • At least 2 years of experience working with the