Senior Product Security Engineer

Enterprises hand Cohere their most sensitive data and put our models inside workflows they can't afford to get wrong. Securing that means working on problems the industry hasn't settled yet, such as:

• What authorization means when an agent acts on a user's behalf
• How to contain tools that consume untrusted input
• Whether tenant boundaries hold when a model can be steered by the data it reads

We're hiring a Senior Product Security Engineer to tackle these challenges alongside engineers building the products. This role involves:

• Reviewing architecture, code, and security-sensitive changes to identify vulnerabilities and recurring design patterns
• Evaluating risks such as prompt injection, unsafe tool use, identity and delegation failures, excessive agency, data exposure, tenant isolation, and sandbox escapes
• Threat modeling new capabilities to identify trust boundaries, abuse cases, and high-impact failure modes before implementation
• Performing hands-on testing, including investigating vulnerabilities, developing proofs of concept, and assessing exploitability and impact
• Building scalable guardrails like secure defaults, approved patterns, reusable controls, review requirements, and automated checks
• Strengthening engineering capability by pairing with engineers, documenting guidance, and helping teams develop security expertise
• Influencing risk decisions by explaining technical findings, business impact, and remediation options to engineers, product leaders, and executives

You may be a good fit if you have:

• Strong software engineering fundamentals and experience independently understanding, testing, and contributing fixes to production codebases
• Proficiency in at least one of Python, Go, or TypeScript
• Experience leading security reviews or threat models for complex production systems, with measurable design or risk improvements
• Understanding of common vulnerability classes, including injection, authorization flaws, IDOR, SSRF, unsafe deserialization, race conditions, cryptographic misuse, and software supply-chain risks
• Knowledge of modern application architecture, including web applications, APIs, OAuth/OIDC, cloud platforms, containers, Kubernetes, and CI/CD systems
• Ability to reason rigorously about untrusted input, authorization, isolation, identity, delegation, and data boundaries. Experience with agentic AI systems is valuable but not required
• Experience driving security improvements across multiple engineering teams, where influence mattered more than authority
• Clear communication skills with both technical and non-technical audiences

Nice to have:

• Experience building or operating security tooling such as SAST, DAST, SCA, custom linters, or policy-as-code
• Experience securing multi-tenant SaaS, enterprise software, or systems processing sensitive customer data
• Offensive security experience through penetration testing, red teaming, or security research
• Experience operating or participating in a vulnerability disclosure or bug bounty program
• Contributions to open-source security projects, published research, conference talks, or credited vulnerability discoveries