Senior Security Engineer - Product

Senior Security Engineer - Product Security Location: San Ramon, CA; Reno, NV Ridgeline is looking for an experienced Product Security Engineer to join our growing Security Engineering team and help us build security into the products our clients rely on. As a Senior Security Engineer at Ridgeline, you will partner with product and engineering teams to identify and solve security problems in our multi-tenant investment management platform, from early design through production. This is a hands-on role, ideal for someone who enjoys going deep on how products work, finding the ways they can break, and shipping fixes, guardrails, and automated systems alongside the engineers who own them. You’ll be the security partner for key product areas, helping teams make sound security decisions without slowing them down. Ridgeline places a strategic emphasis on the responsible and innovative use of AI, integrating it deeply into our platform, internal tools, and engineering processes. A core part of this role is building AI-driven systems that let a small security team cover a large, fast-moving product surface: automating security review, triage, and remediation so every product team gets security support, not just the ones we can reach in person. You will also help secure the AI-powered features we ship to clients, including LLM integrations, agents, and retrieval pipelines. What will you do? • Perform security code reviews and hands-on testing of product features, with a focus on authentication, authorization, tenant isolation, and handling of sensitive financial data. • Own the product vulnerability lifecycle: triage findings from scanners, penetration tests, assess real-world impact, and drive remediation with engineering teams. • Build and improve secure-by-default libraries, frameworks, and guardrails that make the secure path the easy path for product engineers. • Design, build, and operate AI-driven systems, such as LLM- and agent-based pipelines for security code review, threat modeling, vulnerability triage, and remediation, that scale product security coverage across all engineering teams. • Measure the quality of these systems with clear evaluations and feedback loops, and iterate until engineers trust their output. • Assess the security of AI-powered product features, including prompt injection, data leakage, and model or tool misuse risks. • Translate emerging threats and industry vulnerabilities into concrete improvements for Ridgeline’s products. • Mentor engineers and lead secure coding education tailored to the product areas you support. • Foster a collaborative environment rooted in learning, teaching, and trust. Desired Skills and Experience: • 5+ years of experience in product security, application security, or software engineering roles. • Bachelor’s degree in Computer Science or a related discipline, or equivalent practical experience. • Proficiency in one or more modern programming languages (e.g., Kotlin/Java, TypeScript, Python, Go), with the ability to read unfamiliar codebases and write fixes. • Hands-on experience running threat models and security design reviews for web applications, APIs, and distributed services. • Strong understanding of authentication and authorization patterns (OAuth 2.0, OIDC, SAML, RBAC/ABAC) and how they fail in practice. • In-depth understanding of common application and API vulnerabilities (OWASP Top 10, OWASP API Security Top 10, CWE) and practical mitigation strategies. • Experience performing manual security testing and code review, and validating findings from automated tools. • Clear, thoughtful communicator who can explain security risk and tradeoffs to engineers, product managers, and leadership. • Strong sense of ownership, with a track record of driving security fixes to completion across teams. • Experience working closely with product teams, balancing security requirements against delivery timelines and user experience. • AI security fluency: can evaluate risks tied to LLM-powered features, agents, embeddings, and third-party model APIs. • Experience building production software or automation that integrates LLMs or agents into real workflows, including prompt and tool design, evaluation, and handling of false positives and failure modes. Nice to haves: • Experience securing multi-tenant SaaS platforms, ideally in financial services or another regulated industry. • Familiarity with AWS, particularly around IAM, container services, Lambda, and related infrastructure. • Experience running a bug bounty program or triaging findings from third-party penetration tests. • Experience with agent frameworks, retrieval pipelines, or LLM evaluation tooling, or a portfolio of AI-driven security projects (open source, research, or internal tools). • Security research, CVEs, bug bounty participation, open-source contributions, or other community involvement. Compensation and Benefits The typical starting salary range for this role is: $149,500 - $224,500. Final compensation amounts are determined by multiple factors, including candidate experience and expertise, and may vary from the amount listed above. As an employee at Ridgeline, you’ll have many opportunities for advancement in your career and can make a true impact on the product. In addition to the base salary, Ridgeline employees can participate in our Company Stock Plan subject to the applicable Stock Option Agreement. We also offer rich benefits that reflect the kind of organization we want to be: one in which our employees feel valued and are inspired to bring their best selves to work. These include unlimited vacation, educational and wellness reimbursements, and $0 cost employee insurance plafis. Please check out our Careers page for a more comprehensive overview of our perks and benefits. About Ridgeline Ridgeline is building the next generation of investment management technology. Founded by Tech visionary Dave Duffield, Ridgeline delivers a modern, cloud-native platform designed to transform how investment firms operate. As AI reshapes the future of work, Ridgeline is investing deeply in enabling every employee — across technical, operational, and business functions — to adopt and leverage AI skillfully. We believe AI transformation is not simply about deploying tools; it’s about fundamentally evolving how organizations learn, operate, and make decisions. To help lead that transformation, we’re building a new AI Enablement function focused on enterprise-wide learning, workforce transformation, and organizational adoption. Ridgeline is proud to be a community-minded, discrimination-free equal opportunity workplace. Ridgeline processes the information you submit in connection with your application in accordance with the Ridgeline Candidate Privacy Policy. Please review the Ridgeline Candidate Privacy Policy in full to understand our privacy practices and contact us with any questions.