Lead Product Security Engineer — OrbitronAI

🌟 Why Join OrbitronAI?

- Massive Impact, Real Ownership → Ship end-to-end features, own outcomes, and see your work power mission-critical systems.

- Battle-Tested Leadership → Learn and grow with seasoned leaders who bring deep industry expertise and zero ego.

- Cutting Edge Stack → Work with GenAI frontier models, Java, Python, Go, TypeScript, GCP & edge compute, Vector DBs, DAG engines.

🧬 Our Cultural DNA

- Hustle → Move with urgency, bias for action, celebrate shipping.

- Ownership & Commitment → Act like a founder — your decisions shape the company.

- Founder's Mindset → Challenge ideas, not people. Seek truth, not consensus.

- Continuous Learning → No legacy thinking; we invest in upskilling and sponsor courses & conferences.

Why This Role

- The Lead Product Security Engineer is our first dedicated product-security hire and plays a vital role in designing, building, and embedding security into how we build software at OrbitronAI.

- You will tackle complex product-security problems in a technically and regulatory challenging environment — autonomous AI agents operating in regulated industries — and build the product-security function from the ground up. You will work hand-in-hand with engineering, partnering with developers to shift security left rather than managing a team on day one. You will be an evangelist for secure-by-design and promote the right security behaviours across the organisation.

- The main focus areas for this role include:

- Application & API security — secure design, secure code review, threat modeling, OWASP

- Secure SDLC — embedding SAST/DAST/SCA and security gates into the CI/CD pipeline

- AI / autonomous-agent security — prompt injection, excessive agency, tool/permission abuse, data exfiltration, runtime guardrails, agent observability

- Cloud & supply-chain security on GCP — IAM/workload identity, secrets, artifact integrity

- Penetration testing, vulnerability investigations, security reviews and audits

- Translating ISO 27001 / SOC 2 / GDPR / NIST into engineering controls and evidence

- Internal and external communication of security practices, and (with DevOps/IT) incident response

Requirements

- Hands-on technical leader who gets her/his hands dirty in code and design.

- A strong technical background in application & API security, secure SDLC, threat modeling, and OWASP, with working knowledge of vulnerability management, incident response, and penetration testing (external/internal). Familiarity with SIEM/EDR concepts is useful but not the core of this role.

- Advanced knowledge of cloud security on GCP (IAM, workload identity, secrets management, CSPM), plus container and CI/CD pipeline security, and familiarity working in Agile environments.

- Experience with — or a strong appetite to own — AI/LLM and autonomous-agent security. This is core to the role: our product is autonomous agents executing real work in regulated environments.

- Emotional intelligence and the ability to build trust with engineers and influence without authority, while managing the needs and expectations of internal and external (customer) stakeholders.

- Experience with Red/Blue teaming and database security a plus.

Strongly preferred

- You have built or stood up a product-security function from scratch.

Qualifications

- BE/MS/PhD in computer science, security, or a related field — or equivalent hands-on experience.

- 10+ years of security experience showing progression through roles of increasing responsibility.

- Current industry certifications a plus (e.g. CISSP, CISM, OSCP) — valued, but not a substitute for demonstrated hands-on capability.

- Strong technical leadership, stakeholder management, and communication skills.