Security architect securing Thomson Reuters’ legal, tax, compliance, government, and media technology platforms. Leading architecture reviews, cloud security, threat modelling, and AI system risk controls.
About the role
- Product Security Engineer securing Cohere’s enterprise AI products and foundation models. Reviewing architecture, threat modeling capabilities, and testing vulnerabilities across production systems.
Responsibilities
- Lead security reviews of architecture, code, and security-sensitive changes
- Evaluate risks in AI-powered products, including prompt injection, unsafe tool use, identity and delegation failures, excessive agency, data exposure, tenant isolation, and sandbox escapes
- Threat model new capabilities by identifying trust boundaries, abuse cases, and high-impact failure modes
- Translate findings into practical, prioritized mitigations
- Investigate suspected vulnerabilities and develop proofs of concept
- Assess exploitability and impact and partner with engineers through remediation
- Develop secure defaults, approved patterns, reusable controls, review requirements, and automated checks
- Pair with engineers and document practical security guidance
- Help product teams develop durable security expertise
- Explain technical findings, business impact, and remediation options to engineers, product leaders, and executives
Requirements
- Strong software engineering fundamentals and ability to independently understand, test, and contribute fixes to production codebases
- Proficiency in at least one of Python, Go, or TypeScript
- Experience leading security reviews or threat models for complex production systems
- Understanding of injection, authorization flaws, IDOR, SSRF, unsafe deserialization, race conditions, cryptographic misuse, and software supply-chain risks
- Understanding of web applications, APIs, OAuth/OIDC, cloud platforms, containers, Kubernetes, and CI/CD systems
- Ability to reason about untrusted input, authorization, isolation, identity, delegation, and data boundaries
- Experience driving security improvements involving multiple engineering teams
- Clear communication with technical and non-technical audiences
- Experience with SAST, DAST, SCA, custom linters, or policy-as-code (nice to have)
- Experience securing multi-tenant SaaS, enterprise software, or systems processing sensitive customer data (nice to have)
- Offensive security experience through penetration testing, red teaming, or security research (nice to have)
- Experience with vulnerability disclosure or bug bounty programs (nice to have)
- Open-source security contributions, published research, conference talks, or credited vulnerability discoveries (nice to have)
Benefits
- A weekly lunch stipend of $75/£75 or equivalent in your local currency for lunch
- Full health and dental benefits, including a separate budget for mental health
- RRSP matching, 401K, Pension Scheme
- 100% Parental Leave top-up for up to 6 months, for either parent
- Annual enrichment benefits: arts & culture, fitness/wellness, quality time, and a workspace improvement credit
- Education & learning stipend for conferences, courses, and coaching
- 6 weeks of paid vacation (30 working days)
- Budget for traveling to other offices if you are remote, plus an annual company offsite
- Co-working benefit for those not near an office
- $500 home office stipend
- Daily lunch program, snacks, and regular community and social events for those in the office
Job title
Job type
Experience level
Salary
Degree requirement
No Education Requirement
Tech skills
Location requirements
Report this job
Found something wrong with the page? Please let us know by submitting a report below.
Ingénieur cybersécurité renforçant la posture de sécurité d’EDC, société canadienne de financement du commerce international. Intégration de contrôles, DevSecOps et sécurité de l’IA.
Cybersecurity Engineer strengthening security across EDC’s cloud, applications, and enterprise technology. Supporting secure delivery and AI/ML security for Canada’s export finance corporation.
Cisco security solutions designer supporting pre - sales architecture, demonstrations, and technical presentations. Protecting customer application environments with Cisco security technologies.
Senior Program Manager driving enterprise cybersecurity programs for NBCUniversal, a global media and entertainment company. Coordinating technical delivery, operational change, adoption, risk, and executive reporting.
Data Center Security Officer securing Salute’s critical infrastructure facilities. Conducting patrols, access control, surveillance, incident response, and emergency support.
Head of Information Security leading OpenZeppelin’s enterprise security, privacy, IT, and AI governance programs. Securing open - source infrastructure used across onchain finance and digital assets.
Red Team Security Engineer evaluating Motive's fleet - management platform and cloud environments. Executing adversary simulations, validating detection coverage, and driving remediation of security issues.
Security Specialist securing AXON Networks’ AI - driven ISP orchestration platform, cloud infrastructure and connected networking devices. Managing vulnerability scanning, CVE validation, risk prioritization and remediation.
Information Systems Security Manager securing RideCo’s cloud - based on - demand transit platform. Leading compliance, risk management, incident response, and security operations.