Senior Product Security Engineer

About the role

Anyscale is seeking a Senior Product Security Engineer to lead the secure software development lifecycle and collaborate with engineering to integrate security into product development. The role is based in India.

Responsibilities

• Own and operate a scalable secure software development lifecycle, including threat modeling, security requirements, and secure design practices.
• Partner with engineering on security features and secure-by-design architecture, from early design through implementation.
• Review the security of existing systems and new initiatives, and turn findings into actionable work.
• Own vulnerability management for what we ship, including enumeration of components, mapping of known vulnerabilities, and accurate posture reporting on demand.
• Drive vulnerabilities to resolution with engineering against defined Service Level Agreements (SLAs).
• Own software composition analysis, secret scanning, and static application security testing (SAST) across product repositories, setting the bar for secure-development checks.
• Mentor other engineers and raise the security bar across the organization.

Requirements

• 8+ years in product or application security, with senior-level depth, ideally at a high-growth startup.
• Demonstrated ownership of a secure software development lifecycle at scale, including threat modeling and secure design review.
• A strong hands-on background partnering with engineering on security features and architecture, not just reporting findings.
• Deep experience with software composition analysis, secret scanning, and SAST or secure-development tooling in real repositories.
• A solid understanding of software supply chain security and how to enumerate what an organization ships, including SBOM approaches.
• Experience triaging vulnerabilities using CVSS and business context and driving them to resolution with engineering.
• The communication and seniority to set direction, review others' work, and raise the bar for those around you.

Qualifications

• Experience producing vulnerability or security posture reporting for enterprise or regulated customers.
• Familiarity with container artifact security, including image scanning, signing, and SBOM generation.
• Experience building or maturing an SSDL program at scale.
• A background in AI or ML platforms or distributed systems.