Senior Product Security Engineer
for section headings. Use - for any list of duties/requirements/benefits, and
for prose. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions. Also remove "Important Notice" etc. Also remove "Company Overview" maybe we can treat as About the role? Actually "Company Overview" is a section heading but not listed as allowed headings? Allowed headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We should map content to these headings. The posting includes Company Overview (we could put under About the role? maybe combine). Role description maybe under About the role. Key Responsibilities under Responsibilities. Qualifications/Skills under Qualifications and Skills (maybe combine). Why You'll Love Working With Us under Benefits (salary/benefits). No explicit Pay or Schedule, so omit those sections.
We must not emit heading with filler. So we need to ensure each heading has substantive content.
We need to preserve all substantive information, not invent or summarize away detail. So we need to keep details from Company Overview, Role, Key Responsibilities, Qualifications/Skills, Why You'll Love Working With Us.
We need to format as HTML fragment.
Let's extract content:
Company Overview paragraph(s):
"Function Health is the AI operating system for health, designed to empower people to live 100 healthy years. We are redefining how individuals understand, measure, and improve their health by moving beyond reactive care and enabling proactive, data-driven insight into human biology. Function has been recognized as one of Fast Company’s Most Innovative Companies of 2024, and is venture-backed by Andreessen Horowitz (a16z). Hundreds of thousands of members have joined Function to take control of their health.Through advanced diagnostics, deep biomarker testing, longitudinal data, and AI-enabled insights, Function equips members with actionable intelligence to take control of both the quality and length of their lives.Function recently announced a $298M Series B and is entering its next chapter of growth. As we scale, the quality and durability of our People systems, data, and insights will directly shape our ability to attract, retain, and support exceptional talent.We are growing our team and seeking out world-class talent that deeply believes in our mission to positively impact global health, has a relentless bias toward action, and a growth mindset. Function fosters a collaborative and dynamic environment where every day we build the future."
Role paragraph:
"Function Health is building out a dedicated product security team to protect our members and platform as we scale. As a Senior Product Security Engineer, you'll work shoulder-to-shoulder with engineering and product teams to embed security into every stage of development: design, code, test, and deploy. This role is hands-on and impact-driven. You'll be expected to identify risks, build guardrails, and ship tools that raise the security bar without slowing teams down.Our engineering org is moving toward AI-first code review, autonomous adversarial testing, and security gates that run without human approval for low-risk changes. You'd be building the systems that make that possible and safe. If you've been waiting for a security role where the answer to "can we automate this?" is usually yes, this is it.We're looking for someone who thrives on solving hard technical problems, knows how to build security into systems the right way, and is excited about what AI-assisted engineering means for the future of the discipline."
Key Responsibilities list:
- Design and deploy AI-powered security agents into CI/CD: automated code review, risk classification, escalation logic, and where possible, auto-remediation.
- Build and operate the security tooling layer across our pipelines: SAST, SCA, secrets scanning, IaC validation, and supply chain integrity checks.
- Conduct threat modeling, secure design reviews, and manual security assessments across our apps, APIs, and infrastructure.
- Find vulnerabilities through proactive testing, not just scanner output, and drive them to remediation.
- Partner with engineering teams across our product pillars as the embedded security voice in the room, without being a blocker.
- Own the rollout of secure-by-default development frameworks and controls.
- Connect application-level telemetry to detection and response systems.
- Contribute to incident response and postmortems when product security is involved.
- Shape our long-term product security strategy and roadmap.
Qualifications/Skills list:
- 5+ years of experience in product or application security, software engineering, or a combination of both.
- You've built or operated AI-assisted security tooling, whether that's an agent doing code review, an automated triage pipeline, or custom security automation you designed from scratch.
- Strong Python experience. Familiarity with FastAPI, LangChain, or agentic frameworks is a plus.
- Deep fluency in identifying and exploiting web, API, and application vulnerabilities, well beyond OWASP Top 10.
- Experience embedding security into CI/CD, not just recommending it.
- You can guide engineers through secure design decisions without slowing them down.
- You write documentation and design docs without being asked.
- Bonus: experience with HIPAA or healthcare data, red teaming, or security architecture at scale.
- Your dedication to these responsibilities will directly contribute to the success of our platform and the satisfaction of our users. We are looking for a proactive, skilled, and forward-thinking individual to join our team and help shape the future of our services. To be a strong fit, you embody our Core Values: (list of values). This is a paragraph describing core values; we need to keep it? It's substantive. Should we include under Qualifications? Probably include as part of Qualifications/Skills section.
Why You'll Love Working With Us paragraph:
"We value our team at Function and offer a competitive salary and benefits package, flexible working hours, and a dynamic work environment where creativity and innovation are encouraged. If you are a highly motivated and experienced individual who is passionate about using technology to improve people’s lives, we would love to hear from you."
Also there is diversity statement etc which is boilerplate EEO; we should remove that. Also "At Function, we celebrate diversity..." is EEO boilerplate; remove. Also "Join the Function Health team..." maybe also boilerplate? It's a call to action but could be considered application instruction? It's basically encouraging to join; might be considered boilerplate but it's not exactly application instructions. However it's generic; but we might keep as part of Benefits? It's not specific benefit. Safer to remove generic fluff. The instruction says remove EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The "Join the Function Health team..." is not exactly application instruction but could be considered promotional; but we might keep as part of Benefits? It's not a specific benefit. I'd remove it to stay safe.
Also remove "Important Notice:" etc.
Thus sections:
About the role
containing Company Overview + Role? Could combine. But we need to avoid duplication. We'll put Company Overview and Role description in prose under About the role.
Responsibilities
with - list.
Qualifications
maybe combine Qualifications and Skills. Could have one section Qualifications containing both qualifications and skills list plus core values paragraph. Or separate Qualifications and Skills? The allowed headings include Qualifications and Skills separate. We could split: Qualifications for experience requirements, Skills for technical skills. But we have mixed. Let's create Qualifications for experience and core values, Skills for technical list. However we must not create thin sections; better to have one Qualifications section that includes both. The instruction: "Prefer a few substantive sections over many thin ones." So we can have About the role, Responsibilities, Qualifications/Skills (maybe as one heading "Qualifications" or "Skills"? The allowed headings list includes Qualifications and Skills separate. But we can choose to use only Qualifications heading and include skills there. That's fine.
Benefits: we have "competitive salary and benefits package, flexible working hours, and a dynamic work environment where creativity and innovation are encouraged." That's substantive benefits. So we can have Benefits
with - list.
We should not include Pay or Schedule.
Now produce HTML.
Check for any leftover boilerplate: remove diversity statement, EEO, "At Function, we celebrate diversity..." etc. Remove "Join the Function Health team..." etc. Remove "Important Notice:" etc.
Now craft.
About the role paragraph: combine Company Overview and Role. Ensure we keep all details.
Let's write:
Function Health is the AI operating system for health, designed to empower people to live 100 healthy years. We are redefining how individuals understand, measure, and improve their health by moving beyond reactive care and enabling proactive, data-driven insight into human biology. Function has been recognized as one of Fast Company’s Most Innovative Companies of 2024, and is venture-backed by Andreessen Horowitz (a16z). Hundreds of thousands of members have joined Function to take control of their health. Through advanced diagnostics, deep biomarker testing, longitudinal data, and AI-enabled insights, Function equips members with actionable intelligence to take control of both the quality and length of their lives. Function recently announced a $298M Series B and is entering its next chapter of growth. As we scale, the quality and durability of our People systems, data, and insights will directly shape our ability to attract, retain, and support exceptional talent. We are growing our team and seeking out world-class talent that deeply believes in our mission to positively impact global health, has a relentless bias toward action, and a growth mindset. Function fosters a collaborative and dynamic environment where every day we build the future.
Function Health is building out a dedicated product security team to protect our members and platform as we scale. As a Senior Product Security Engineer, you'll work shoulder-to-shoulder with engineering and product teams to embed security into every stage of development: design, code, test, and deploy. This role is hands-on and impact-driven. You'll be expected to identify risks, build guardrails, and ship tools that raise the security bar without slowing teams down. Our engineering org is moving toward AI-first code review, autonomous adversarial testing, and security gates that run without human approval for low-risk changes. You'd be building the systems that make that possible and safe. If you've been waiting for a security role where the answer to "can we automate this?" is usually yes, this is it. We're looking for someone who thrives on solving hard technical problems, knows how to build security into systems the right way, and is excited about what AI-assisted engineering means for the future of the discipline.
Now Responsibilities list.
Now Qualifications/Skills: we need to include experience, AI-assisted tooling, Python, etc, plus core values paragraph.
Let's create - for each bullet.
Core values paragraph: "To be a strong fit, you embody our Core Values:Ruthless Prioritization:We don’t let perfect get in the way of progress.We move quickly to drive value, not perfection.We prioritize what drives impact.We never compromise on standards of excellence.Member-First, Always:We design and deliver like we’re caring for someone we love.We create calendar, actionable, human experience.We prioritize responsiveness, peace of mind, and outcomes.We empower members with truth, clarity, and care.One Team, Moving Fast:We are aligned in purpose, prioritization, and speed.We gather diverse perspectives to make informed decisions.We clear paths for each other and move fast together.We communicate clearly and respectfully, rallying around shared goals.Radical Ownership, Relentless Execution:We don’t just ship– we own outcomes and drive results.We act with urgency and precisionWe anticipate
for prose. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions. Also remove "Important Notice" etc. Also remove "Company Overview" maybe we can treat as About the role? Actually "Company Overview" is a section heading but not listed as allowed headings? Allowed headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We should map content to these headings. The posting includes Company Overview (we could put under About the role? maybe combine). Role description maybe under About the role. Key Responsibilities under Responsibilities. Qualifications/Skills under Qualifications and Skills (maybe combine). Why You'll Love Working With Us under Benefits (salary/benefits). No explicit Pay or Schedule, so omit those sections. We must not emit heading with filler. So we need to ensure each heading has substantive content. We need to preserve all substantive information, not invent or summarize away detail. So we need to keep details from Company Overview, Role, Key Responsibilities, Qualifications/Skills, Why You'll Love Working With Us. We need to format as HTML fragment. Let's extract content: Company Overview paragraph(s): "Function Health is the AI operating system for health, designed to empower people to live 100 healthy years. We are redefining how individuals understand, measure, and improve their health by moving beyond reactive care and enabling proactive, data-driven insight into human biology. Function has been recognized as one of Fast Company’s Most Innovative Companies of 2024, and is venture-backed by Andreessen Horowitz (a16z). Hundreds of thousands of members have joined Function to take control of their health.Through advanced diagnostics, deep biomarker testing, longitudinal data, and AI-enabled insights, Function equips members with actionable intelligence to take control of both the quality and length of their lives.Function recently announced a $298M Series B and is entering its next chapter of growth. As we scale, the quality and durability of our People systems, data, and insights will directly shape our ability to attract, retain, and support exceptional talent.We are growing our team and seeking out world-class talent that deeply believes in our mission to positively impact global health, has a relentless bias toward action, and a growth mindset. Function fosters a collaborative and dynamic environment where every day we build the future." Role paragraph: "Function Health is building out a dedicated product security team to protect our members and platform as we scale. As a Senior Product Security Engineer, you'll work shoulder-to-shoulder with engineering and product teams to embed security into every stage of development: design, code, test, and deploy. This role is hands-on and impact-driven. You'll be expected to identify risks, build guardrails, and ship tools that raise the security bar without slowing teams down.Our engineering org is moving toward AI-first code review, autonomous adversarial testing, and security gates that run without human approval for low-risk changes. You'd be building the systems that make that possible and safe. If you've been waiting for a security role where the answer to "can we automate this?" is usually yes, this is it.We're looking for someone who thrives on solving hard technical problems, knows how to build security into systems the right way, and is excited about what AI-assisted engineering means for the future of the discipline." Key Responsibilities list: - Design and deploy AI-powered security agents into CI/CD: automated code review, risk classification, escalation logic, and where possible, auto-remediation. - Build and operate the security tooling layer across our pipelines: SAST, SCA, secrets scanning, IaC validation, and supply chain integrity checks. - Conduct threat modeling, secure design reviews, and manual security assessments across our apps, APIs, and infrastructure. - Find vulnerabilities through proactive testing, not just scanner output, and drive them to remediation. - Partner with engineering teams across our product pillars as the embedded security voice in the room, without being a blocker. - Own the rollout of secure-by-default development frameworks and controls. - Connect application-level telemetry to detection and response systems. - Contribute to incident response and postmortems when product security is involved. - Shape our long-term product security strategy and roadmap. Qualifications/Skills list: - 5+ years of experience in product or application security, software engineering, or a combination of both. - You've built or operated AI-assisted security tooling, whether that's an agent doing code review, an automated triage pipeline, or custom security automation you designed from scratch. - Strong Python experience. Familiarity with FastAPI, LangChain, or agentic frameworks is a plus. - Deep fluency in identifying and exploiting web, API, and application vulnerabilities, well beyond OWASP Top 10. - Experience embedding security into CI/CD, not just recommending it. - You can guide engineers through secure design decisions without slowing them down. - You write documentation and design docs without being asked. - Bonus: experience with HIPAA or healthcare data, red teaming, or security architecture at scale. - Your dedication to these responsibilities will directly contribute to the success of our platform and the satisfaction of our users. We are looking for a proactive, skilled, and forward-thinking individual to join our team and help shape the future of our services. To be a strong fit, you embody our Core Values: (list of values). This is a paragraph describing core values; we need to keep it? It's substantive. Should we include under Qualifications? Probably include as part of Qualifications/Skills section. Why You'll Love Working With Us paragraph: "We value our team at Function and offer a competitive salary and benefits package, flexible working hours, and a dynamic work environment where creativity and innovation are encouraged. If you are a highly motivated and experienced individual who is passionate about using technology to improve people’s lives, we would love to hear from you." Also there is diversity statement etc which is boilerplate EEO; we should remove that. Also "At Function, we celebrate diversity..." is EEO boilerplate; remove. Also "Join the Function Health team..." maybe also boilerplate? It's a call to action but could be considered application instruction? It's basically encouraging to join; might be considered boilerplate but it's not exactly application instructions. However it's generic; but we might keep as part of Benefits? It's not specific benefit. Safer to remove generic fluff. The instruction says remove EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The "Join the Function Health team..." is not exactly application instruction but could be considered promotional; but we might keep as part of Benefits? It's not a specific benefit. I'd remove it to stay safe. Also remove "Important Notice:" etc. Thus sections:
About the role
containing Company Overview + Role? Could combine. But we need to avoid duplication. We'll put Company Overview and Role description in prose under About the role.Responsibilities
with- list.
Qualifications
maybe combine Qualifications and Skills. Could have one section Qualifications containing both qualifications and skills list plus core values paragraph. Or separate Qualifications and Skills? The allowed headings include Qualifications and Skills separate. We could split: Qualifications for experience requirements, Skills for technical skills. But we have mixed. Let's create Qualifications for experience and core values, Skills for technical list. However we must not create thin sections; better to have one Qualifications section that includes both. The instruction: "Prefer a few substantive sections over many thin ones." So we can have About the role, Responsibilities, Qualifications/Skills (maybe as one heading "Qualifications" or "Skills"? The allowed headings list includes Qualifications and Skills separate. But we can choose to use only Qualifications heading and include skills there. That's fine. Benefits: we have "competitive salary and benefits package, flexible working hours, and a dynamic work environment where creativity and innovation are encouraged." That's substantive benefits. So we can haveBenefits
with- list.
We should not include Pay or Schedule.
Now produce HTML.
Check for any leftover boilerplate: remove diversity statement, EEO, "At Function, we celebrate diversity..." etc. Remove "Join the Function Health team..." etc. Remove "Important Notice:" etc.
Now craft.
About the role paragraph: combine Company Overview and Role. Ensure we keep all details.
Let's write:
Function Health is the AI operating system for health, designed to empower people to live 100 healthy years. We are redefining how individuals understand, measure, and improve their health by moving beyond reactive care and enabling proactive, data-driven insight into human biology. Function has been recognized as one of Fast Company’s Most Innovative Companies of 2024, and is venture-backed by Andreessen Horowitz (a16z). Hundreds of thousands of members have joined Function to take control of their health. Through advanced diagnostics, deep biomarker testing, longitudinal data, and AI-enabled insights, Function equips members with actionable intelligence to take control of both the quality and length of their lives. Function recently announced a $298M Series B and is entering its next chapter of growth. As we scale, the quality and durability of our People systems, data, and insights will directly shape our ability to attract, retain, and support exceptional talent. We are growing our team and seeking out world-class talent that deeply believes in our mission to positively impact global health, has a relentless bias toward action, and a growth mindset. Function fosters a collaborative and dynamic environment where every day we build the future.
Function Health is building out a dedicated product security team to protect our members and platform as we scale. As a Senior Product Security Engineer, you'll work shoulder-to-shoulder with engineering and product teams to embed security into every stage of development: design, code, test, and deploy. This role is hands-on and impact-driven. You'll be expected to identify risks, build guardrails, and ship tools that raise the security bar without slowing teams down. Our engineering org is moving toward AI-first code review, autonomous adversarial testing, and security gates that run without human approval for low-risk changes. You'd be building the systems that make that possible and safe. If you've been waiting for a security role where the answer to "can we automate this?" is usually yes, this is it. We're looking for someone who thrives on solving hard technical problems, knows how to build security into systems the right way, and is excited about what AI-assisted engineering means for the future of the discipline.
Now Responsibilities list. Now Qualifications/Skills: we need to include experience, AI-assisted tooling, Python, etc, plus core values paragraph. Let's create- for each bullet. Core values paragraph: "To be a strong fit, you embody our Core Values:Ruthless Prioritization:We don’t let perfect get in the way of progress.We move quickly to drive value, not perfection.We prioritize what drives impact.We never compromise on standards of excellence.Member-First, Always:We design and deliver like we’re caring for someone we love.We create calendar, actionable, human experience.We prioritize responsiveness, peace of mind, and outcomes.We empower members with truth, clarity, and care.One Team, Moving Fast:We are aligned in purpose, prioritization, and speed.We gather diverse perspectives to make informed decisions.We clear paths for each other and move fast together.We communicate clearly and respectfully, rallying around shared goals.Radical Ownership, Relentless Execution:We don’t just ship– we own outcomes and drive results.We act with urgency and precisionWe anticipate
- list.
We should not include Pay or Schedule.
Now produce HTML.
Check for any leftover boilerplate: remove diversity statement, EEO, "At Function, we celebrate diversity..." etc. Remove "Join the Function Health team..." etc. Remove "Important Notice:" etc.
Now craft.
About the role paragraph: combine Company Overview and Role. Ensure we keep all details.
Let's write: