Product Security Engineer

The role

Here, you'll be part of changing how the deals behind the largest asset class get transacted, and will help shape the future of real estate.

We're looking for a Product Security Engineer to own the security of Orbital's product: the AI agent our customers use, the platform it runs on, and how we build both.

Our customers are law firms and real estate businesses. They trust us with confidential transaction documents, and they ask hard questions about how we protect them. Our product is an AI agent that reads those documents, calls tools and runs code on a lawyer's behalf. That brings the usual cloud security work and a newer set of risks: prompt injection, agents acting on untrusted input, and attackers using AI to move faster than before.

You'll get a chance to 👩‍💻 👨‍

Build an automated security harness. Put agents to work on our product: continuous red-team and blue-team loops that probe the agent, the platform and our code, find vulnerabilities, and propose or ship the fix. Manual review should be justified when required and automatic harness improvement is expected.
Own vulnerability management end to end. Define how we classify severity and the response time each level demands, so a critical CVE gets fixed the same day. Automate patching, dependency and image scanning, and make sure findings reach an owner and get closed.
Secure an AI agent in production. Threat-model how our agent handles untrusted documents, emails and web content, and the tools and sandboxes it uses. Design defences against prompt injection and data exfiltration, and test them.
Make security part of how we build. Review designs and changes that touch authentication, tenant isolation, secrets and data handling. Turn recurring findings into automated checks so the protection holds without depending on someone remembering.
Respond to security incidents. Lead the technical response when something goes wrong: containment, investigation and the fix. Build the technical side of our breach playbooks with our information security lead, and run the review afterwards.
Choose and run our security tooling. Evaluate and roll out a cloud security platform (such as Wiz) and the detection, alerting and logging we need across AWS and Azure. As our only product security specialist, use tooling and AI agents to cover more ground than one person could alone.
Test our defences. Run red-team exercises, manage external penetration testers, and run breach drills with engineering so everyone knows their part before it matters.
Close the loop on findings. Fix what penetration tests and security researchers report to us, run responsible disclosure, and keep the technical evidence for our SOC 2 and ISO 27001 controls current, working with our information security lead.
Make the work visible. Show leadership and engineering what the harness finds, what has been fixed and what risk remains, in plain language, with a recommendation for each open risk.

You should apply if you

You build with agents. You'd rather put an agent loop on a problem than repeat a manual review. You've used AI agents to find, triage or fix security issues, and you aim for automation that leaves people to review only the exceptions.
You have deep, hands-on security engineering experience. You've owned security for a cloud-native product or platform and can do the work yourself, from reading code and IAM policies to configuring detection and running an investigation.
You know AWS security well. IAM, network design, KMS, GuardDuty, Security Hub, CloudTrail and how they fit together in a real production environment.
You've led incident response. You've run a real security incident, including containment, investigation, communication and the follow-up, and you stay clear-headed under pressure.
You take application and AI security seriously. You understand OWASP-class vulnerabilities, and you're interested in the new risks that come with LLM agents, such as prompt injection and over-broad tool access.
You understand the product and the business. You know why a finding matters to our customers and our commercial position. You can tell a theoretical finding from one that puts customer data at risk, you spend effort where the risk is real, and you don't disappear down technical rabbit holes.
You help teams ship safely. You find the secure way to do what the team needs, and you block work only when the risk justifies it. When you do, you explain why clearly enough that engineers understand and agree.
You work independently. As our first in-house product security engineer, you'll set your own priorities, build the programme, and know when to bring in outside help.
You bring people with you. You can explain a security risk to an engineer, a lawyer and a board member, adjusting the detail for each, and you change how teams work through influence rather than authority.

You'll most likely come from a security engineering, product security or application security role at a fast-growing startup, or from a security consultancy with hands-on delivery. We're open to different backgrounds if you can show the depth, judgement and automation-first approach this role needs.

Product Security Engineer

The role

Product Security Engineer

The role

A bit about us

You'll get a chance to 👩‍💻 👨‍

You should apply if you

It would also be nice if you have

About Orbital

Similar jobs at other companies

System Requirements Engineer, In-Cabin Perception

シニアコンピュータビジョン／機械学習エンジニア・Digital Twin Platform

Senior Technical Program Manager, Active Learning Loop

バックエンドエンジニア・Robot Platform Software

データエンジニア・City Data Platform Development（障害者雇用）

システム要求エンジニア・In-Cabin Perception

Interview questions

Orbital