Senior Engineer - Product Security
for headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to decide which sections have content.
From posting: There's a "Why Join GEICO?" intro paragraph, then description of role, then "What You Will Do" (responsibilities), then "AI and Product Security Focus" (maybe part of responsibilities or qualifications?), then "Required Qualifications", "Preferred Qualifications", "How You Work", "What Success Looks Like", then "Annual Salary $100,000.00 - $215,000.00". Also mention "GEICO Pledge" etc but that's fluff.
We need to extract substantive info and put into appropriate sections.
We must not include boilerplate like EEO, legal, etc. Also remove duplicated lines, navigation, cookie, application instructions.
We need to decide sections:
- About the role: maybe the introductory paragraph about GEICO and the role summary: "GEICO is seeking a Senior Security Engineer to strengthen the security of AI-enabled products and the engineering platforms that support them. This role combines product security judgment with hands-on software development..." That's about the role.
- Responsibilities: "What You Will Do" list (bullet points). Also "AI and Product Security Focus" could be part of responsibilities or separate? Could be part of responsibilities as well. We'll include under Responsibilities.
- Requirements: Could be "Required Qualifications". That's requirements.
- Qualifications: Could be "Preferred Qualifications". But we already have Required Qualifications; maybe we treat Required as Requirements, Preferred as Qualifications? The instruction says use headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we need to map content accordingly.
We have Required Qualifications (must-have) and Preferred Qualifications (nice-to-have). Could put Required under Requirements, Preferred under Qualifications.
Skills: maybe we can extract from Required Qualifications: proficiency in Python, experience with GitHub, etc. But we might not need separate Skills if content overlaps. However we can create a Skills section summarizing technical skills: Python, GitHub, PostgreSQL, etc. But we must not invent or summarize away detail; we can list them as bullet points from the posting.
Benefits: The posting mentions GEICO Pledge: Great Company, Great Culture, Great Rewards, Great Careers. Also "Competitive pay, benefits, and flexibility". But not specific benefits like health insurance etc. The instruction: never create Benefits section unless posting actually states them. It does mention "Great Rewards: Competitive pay, benefits, and flexibility". That's vague but mentions benefits. Could we include a Benefits section with that? It's somewhat generic but it's stated. Might be okay to include a short paragraph.
Pay: Salary range given: Annual Salary $100,000.00 - $215,000.00. So we can create Pay section with that.
Schedule: Not mentioned. So omit Schedule.
We must not include headings with filler text. So we will include only sections with real content.
Thus sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay.
We need to use for each heading. Use - for any list of duties/requirements/benefits. Use
for prose.
We must preserve ALL substantive information; do not invent or summarize away detail. So we need to keep details as much as possible.
Let's extract content.
About the role: Paragraph(s) describing GEICO and role.
From posting:
"Why Join GEICO? At GEICO, we offer a rewarding career where your ambitions are met with endless possibilities. Every day we honor our iconic brand by offering quality coverage to millions of customers and being there when they need us most. We thrive on relentless innovation to exceed our customers' expectations while making a real impact on local communities nationwide. Founded in 1936, GEICO is a member of the Berkshire Hathaway family of companies and one of the largest auto insurers in the United States. When you join our company, we want you to feel valued, supported, and proud to work here. That's why we offer the GEICO Pledge: Great Company, Great Culture, Great Rewards, and Great Careers. GEICO is seeking a Senior Security Engineer to strengthen the security of AI-enabled products and the engineering platforms that support them. This role combines product security judgment with hands-on software development. The engineer will assess designs, review code, build security automation, and partner with engineering and product teams to translate business needs and security requirements into practical, production-ready solutions. The successful candidate operates effectively with high-level direction, clarifies ambiguous problems, prioritizes competing work, and owns deliverables through completion. This is a Senior Engineer role focused on vital team-level contributions and technical leadership within the team, rather than enterprise-wide architecture ownership."
We can keep that as About the role.
Responsibilities: "What You Will Do" bullet list plus AI and Product Security Focus.
Let's extract bullet points from "What You Will Do":
- Provide technical leadership within the team for AI security, product security, secure design, and security engineering work.
- Plan, estimate, prioritize, and deliver engineering work to schedule while managing multiple concurrent priorities and context switches.
- Design, build, test, deploy, and troubleshoot production-ready security services, integrations, automation, and developer tooling.
- Perform threat modeling and security architecture reviews for AI-enabled applications, services, APIs, data flows, agentic workflows, and supporting platforms.
- Review code and designs for authentication, authorization, role-based access control, input validation, data protection, logging, error handling, database access, and other security concerns.
- Translate business needs, customer feedback, and security requirements into clear technical requirements, implementation plans, and measurable outcomes.
- Use data and risk context to recommend priorities and make sound design or configuration decisions, with attention to security, compliance, privacy, reliability, and customer data handling.
- Work across engineering, product, platform, risk, and cybersecurity teams to remove blockers, resolve issues, and drive agreed actions to completion.
- Proactively identify process, tooling, and control gaps, then implement practical improvements that reduce manual effort and strengthen security outcomes.
- Contribute significantly to design, code, security, observability, performance, and operational-readiness reviews using established architecture and engineering guidance.
- Document technical decisions, operating procedures, support guidance, and lessons learned so solutions can be maintained and improved by the team.
- Help teammates overcome technical obstacles and share knowledge through reviews, pairing, technical discussions, and clear documentation.
Then "AI and Product Security Focus" bullet points:
- Assess security risks associated with AI models, agents, prompts, retrieval-augmented generation, model context protocols, tools, data sources, memory, and downstream actions.
- Apply secure-by-design practices to AI-enabled systems, including least privilege, trustworthy identity, authorization boundaries, input and output controls, secrets protection, audit logging, data governance, and resilient failure handling.
- Build or integrate automated safeguards, evaluation workflows, security tests, and monitoring that help teams identify and reduce AI and application security risk throughout the development lifecycle.
- Partner with developers to provide actionable remediation guidance and validate that security issues are addressed effectively.
We can combine these under Responsibilities as a list.
Requirements: "Required Qualifications" bullet list.
Let's extract:
- Solid professional experience in software engineering, security engineering, product security, application security, or a related technical field.
- Hands-on experience writing, reviewing, testing, and troubleshooting code, with strong proficiency in Python or a comparable modern programming language.
- Experience with full-stack or platform development using tools and technologies such as GitHub, Git, terminal and CLI workflows, APIs, relational databases such as PostgreSQL, and automated testing.
- Practical experience conducting threat modeling, secure design reviews, architecture reviews, or secure code reviews.
- Working knowledge of common application and API security risks, secure authentication and authorization patterns, input validation, logging, error handling, database security, and secure SDLC practices.
- Ability to organize complex work, create realistic project plans, manage dependencies, communicate status and risks, and drive work to completion.
- Ability to make progress with incomplete information, ask effective clarifying questions, and apply sound engineering judgment under ambiguity.
- Strong written and verbal communication skills for technical and non-technical audiences.
- Ability to listen to different perspectives, incorporate feedback, and confidently explain a well-reasoned recommendation.
- Experience integrating AI-assisted development practices into the software development lifecycle while retaining accountability for architecture, technical decisions, testing, security, and operational readiness.
- Proven ability to validate AI-generated outputs, identify inaccurate or insecure recommendations, and ensure resulting code meets expectations for security, quality, maintainability, reliability, testability, and compliance.
- Strong portfolio of hands-on engineering work demonstrating effective use of AI-enabled development capabilities, including code generation, code review, debugging, refactoring, test generation, documentation, and engineering automation.
- Demonstrated track record of leveraging AI-assisted software development tools and workflows to design, develop, test, troubleshoot, and deliver production-quality software solutions.
- Experience working in an Agentic Development Environment where AI assistants or coding agents can inspect project context, propose or modify code, generate tests, summarize repositories, create pull requests, and support iterative debugging while the engineer remains accountable for correctness, security, and maintainability.
- Hands-on familiarity with modern AI-enabled developer tools and workflows such as Cursor, Claude Code, GitHub Copilot, GitHub pull request automation, AI-assisted code review, repository-aware chat, terminal-based coding agents, and secure prompt/context management for engineering tasks.
That's a lot; we need to keep all.
Qualifications: "Preferred Qualifications" bullet list.
Extract:
- Experience building or securing generative AI, agentic AI, RAG, MCP-based integrations, or AI-enabled developer workflows.
- Experience with Python application frameworks, data validation libraries such as Pydantic, PostgreSQL, cloud services, containers, CI/CD, and infrastructure automation.
- Experience integrating security testing and controls into engineering workflows and developer tooling.
- Familiarity with product security, cloud security, API security, threat modeling methodologies, and security or compliance frameworks relevant to enterprise environments.
- Experience balancing near-term delivery with maintainability, operational readiness, and longer-term improvement opportunities.
- Experience designing guardrails, evaluation frameworks, security controls, and governance mechanisms for AI-generated code and AI-assisted engineering workflows.
- Experience building, extending, or securing AI-assisted development platforms, coding assistants, developer agents, agentic workflows, MCP integrations, RAG systems, or AI-enabled engineering productivity solutions.
Skills: Could extract from Required Qualifications: proficiency in Python, experience with GitHub, Git, terminal/CLI, APIs, PostgreSQL, automated testing, threat modeling, secure design, etc. But we might just list skills as bullet points derived from Required Qualifications. However we must not invent or summarize away detail; we can list them as they appear. But we already have them in Requirements; maybe we can skip Skills section to avoid duplication. However the instruction says we can have Skills section if we have content. But we risk duplication. Perhaps better to not include Skills and instead put those details under Requirements. But the headings list includes Skills; we can omit if no specific content beyond what's already covered. The instruction: "Prefer a few substantive sections over many thin ones." So we can omit Skills if it would be thin.
Benefits: The posting mentions GEICO Pledge: Great Company, Great Culture, Great Rewards, Great Careers. Also "Competitive pay, benefits, and flexibility". We can capture that as Benefits section: "GEICO offers a rewarding career with the GEICO Pledge: Great Company, Great Culture, Great Rewards, and Great Careers, including competitive pay, benefits, and flexibility to support well-being and future." That's substantive.
Pay: Salary range.
We must not include boilerplate like EEO, legal, etc. Also remove duplicated lines.
- for any list of duties/requirements/benefits. Use
for prose. We must preserve ALL substantive information; do not invent or summarize away detail. So we need to keep details as much as possible. Let's extract content. About the role: Paragraph(s) describing GEICO and role. From posting: "Why Join GEICO? At GEICO, we offer a rewarding career where your ambitions are met with endless possibilities. Every day we honor our iconic brand by offering quality coverage to millions of customers and being there when they need us most. We thrive on relentless innovation to exceed our customers' expectations while making a real impact on local communities nationwide. Founded in 1936, GEICO is a member of the Berkshire Hathaway family of companies and one of the largest auto insurers in the United States. When you join our company, we want you to feel valued, supported, and proud to work here. That's why we offer the GEICO Pledge: Great Company, Great Culture, Great Rewards, and Great Careers. GEICO is seeking a Senior Security Engineer to strengthen the security of AI-enabled products and the engineering platforms that support them. This role combines product security judgment with hands-on software development. The engineer will assess designs, review code, build security automation, and partner with engineering and product teams to translate business needs and security requirements into practical, production-ready solutions. The successful candidate operates effectively with high-level direction, clarifies ambiguous problems, prioritizes competing work, and owns deliverables through completion. This is a Senior Engineer role focused on vital team-level contributions and technical leadership within the team, rather than enterprise-wide architecture ownership." We can keep that as About the role. Responsibilities: "What You Will Do" bullet list plus AI and Product Security Focus. Let's extract bullet points from "What You Will Do": - Provide technical leadership within the team for AI security, product security, secure design, and security engineering work. - Plan, estimate, prioritize, and deliver engineering work to schedule while managing multiple concurrent priorities and context switches. - Design, build, test, deploy, and troubleshoot production-ready security services, integrations, automation, and developer tooling. - Perform threat modeling and security architecture reviews for AI-enabled applications, services, APIs, data flows, agentic workflows, and supporting platforms. - Review code and designs for authentication, authorization, role-based access control, input validation, data protection, logging, error handling, database access, and other security concerns. - Translate business needs, customer feedback, and security requirements into clear technical requirements, implementation plans, and measurable outcomes. - Use data and risk context to recommend priorities and make sound design or configuration decisions, with attention to security, compliance, privacy, reliability, and customer data handling. - Work across engineering, product, platform, risk, and cybersecurity teams to remove blockers, resolve issues, and drive agreed actions to completion. - Proactively identify process, tooling, and control gaps, then implement practical improvements that reduce manual effort and strengthen security outcomes. - Contribute significantly to design, code, security, observability, performance, and operational-readiness reviews using established architecture and engineering guidance. - Document technical decisions, operating procedures, support guidance, and lessons learned so solutions can be maintained and improved by the team. - Help teammates overcome technical obstacles and share knowledge through reviews, pairing, technical discussions, and clear documentation. Then "AI and Product Security Focus" bullet points: - Assess security risks associated with AI models, agents, prompts, retrieval-augmented generation, model context protocols, tools, data sources, memory, and downstream actions. - Apply secure-by-design practices to AI-enabled systems, including least privilege, trustworthy identity, authorization boundaries, input and output controls, secrets protection, audit logging, data governance, and resilient failure handling. - Build or integrate automated safeguards, evaluation workflows, security tests, and monitoring that help teams identify and reduce AI and application security risk throughout the development lifecycle. - Partner with developers to provide actionable remediation guidance and validate that security issues are addressed effectively. We can combine these under Responsibilities as a list. Requirements: "Required Qualifications" bullet list. Let's extract: - Solid professional experience in software engineering, security engineering, product security, application security, or a related technical field. - Hands-on experience writing, reviewing, testing, and troubleshooting code, with strong proficiency in Python or a comparable modern programming language. - Experience with full-stack or platform development using tools and technologies such as GitHub, Git, terminal and CLI workflows, APIs, relational databases such as PostgreSQL, and automated testing. - Practical experience conducting threat modeling, secure design reviews, architecture reviews, or secure code reviews. - Working knowledge of common application and API security risks, secure authentication and authorization patterns, input validation, logging, error handling, database security, and secure SDLC practices. - Ability to organize complex work, create realistic project plans, manage dependencies, communicate status and risks, and drive work to completion. - Ability to make progress with incomplete information, ask effective clarifying questions, and apply sound engineering judgment under ambiguity. - Strong written and verbal communication skills for technical and non-technical audiences. - Ability to listen to different perspectives, incorporate feedback, and confidently explain a well-reasoned recommendation. - Experience integrating AI-assisted development practices into the software development lifecycle while retaining accountability for architecture, technical decisions, testing, security, and operational readiness. - Proven ability to validate AI-generated outputs, identify inaccurate or insecure recommendations, and ensure resulting code meets expectations for security, quality, maintainability, reliability, testability, and compliance. - Strong portfolio of hands-on engineering work demonstrating effective use of AI-enabled development capabilities, including code generation, code review, debugging, refactoring, test generation, documentation, and engineering automation. - Demonstrated track record of leveraging AI-assisted software development tools and workflows to design, develop, test, troubleshoot, and deliver production-quality software solutions. - Experience working in an Agentic Development Environment where AI assistants or coding agents can inspect project context, propose or modify code, generate tests, summarize repositories, create pull requests, and support iterative debugging while the engineer remains accountable for correctness, security, and maintainability. - Hands-on familiarity with modern AI-enabled developer tools and workflows such as Cursor, Claude Code, GitHub Copilot, GitHub pull request automation, AI-assisted code review, repository-aware chat, terminal-based coding agents, and secure prompt/context management for engineering tasks. That's a lot; we need to keep all. Qualifications: "Preferred Qualifications" bullet list. Extract: - Experience building or securing generative AI, agentic AI, RAG, MCP-based integrations, or AI-enabled developer workflows. - Experience with Python application frameworks, data validation libraries such as Pydantic, PostgreSQL, cloud services, containers, CI/CD, and infrastructure automation. - Experience integrating security testing and controls into engineering workflows and developer tooling. - Familiarity with product security, cloud security, API security, threat modeling methodologies, and security or compliance frameworks relevant to enterprise environments. - Experience balancing near-term delivery with maintainability, operational readiness, and longer-term improvement opportunities. - Experience designing guardrails, evaluation frameworks, security controls, and governance mechanisms for AI-generated code and AI-assisted engineering workflows. - Experience building, extending, or securing AI-assisted development platforms, coding assistants, developer agents, agentic workflows, MCP integrations, RAG systems, or AI-enabled engineering productivity solutions. Skills: Could extract from Required Qualifications: proficiency in Python, experience with GitHub, Git, terminal/CLI, APIs, PostgreSQL, automated testing, threat modeling, secure design, etc. But we might just list skills as bullet points derived from Required Qualifications. However we must not invent or summarize away detail; we can list them as they appear. But we already have them in Requirements; maybe we can skip Skills section to avoid duplication. However the instruction says we can have Skills section if we have content. But we risk duplication. Perhaps better to not include Skills and instead put those details under Requirements. But the headings list includes Skills; we can omit if no specific content beyond what's already covered. The instruction: "Prefer a few substantive sections over many thin ones." So we can omit Skills if it would be thin. Benefits: The posting mentions GEICO Pledge: Great Company, Great Culture, Great Rewards, Great Careers. Also "Competitive pay, benefits, and flexibility". We can capture that as Benefits section: "GEICO offers a rewarding career with the GEICO Pledge: Great Company, Great Culture, Great Rewards, and Great Careers, including competitive pay, benefits, and flexibility to support well-being and future." That's substantive. Pay: Salary range. We must not include boilerplate like EEO, legal, etc. Also remove duplicated lines.