Product Security Engineer

Orbital is the AI platform for real estate legal work. Real estate shapes the world around us: our homes, our workplaces and our cultural landmarks. It’s the infrastructure that powers everyday life and is the world's largest asset class. Yet behind every single deal, real estate and legal teams work hard to navigate decades-old complexity; manually connecting documents, hidden obligations, geo-spatial context, and multiple parties into a path forward. We connect the legal and physical record, so that path is clearer than ever before. Our mission is to make real estate transactions faster, clearer, and less manual. Here, you'll be part of changing how the deals behind the largest asset class get transacted, and will help shape the future of real estate. A bit about us: 🚀 We’re building at the forefront of AI technology, without losing the deeply human expertise our clients depend on. 🏢 Orbital is built with former practising real estate lawyers and 250+ years of combined legal expertise. We're purpose-built for the complexity of real estate: accelerating due diligence, drafting and negotiation, and deal coordination with legal-grade precision. 💰 We've just raised a $60m Series B, led by Brighton Park Capital, to accelerate our global expansion – $75m raised to date. 🤝 We're trusted by 5,000+ real estate professionals, spanning UK Magic Circle and US Am Law 100 firms, to household names like M&S. Leading firms like BCLP, Orrick, Goodwin, Womble Bond Dickinson and Clifford Chance rely on Orbital to remove the busywork, freeing legal and real estate teams to focus on sharp judgment, standout client service, and closing deals faster. 💡 Working at Orbital means joining a bold, ambitious team, with the trust to take ownership and make a real impact from day one. ROLE OVERVIEW 🔎 We're looking for a Product Security Engineer to own the security of Orbital's product: the AI agent our customers use, the platform it runs on, and how we build both. Our customers are law firms and real estate businesses. They trust us with confidential transaction documents, and they ask hard questions about how we protect them. Our product is an AI agent that reads those documents, calls tools and runs code on a lawyer's behalf. That brings the usual cloud security work and a newer set of risks: prompt injection, agents acting on untrusted input, and attackers using AI to move faster than before. You'll be our first in-house product security engineer, taking on work we have so far relied on contractors for. You'll build security into the product rather than review it from outside: you'll decide how we rate a vulnerability and how fast we act on it, build the automated systems that find and fix issues before an attacker does, and set the security bar that engineering builds to. You'll work alongside our product engineers, with the authority to require changes across teams on security grounds, independent of any one team's delivery deadlines. An information security lead will own company-wide policy, compliance and customer assurance, and you'll work closely with them. You won't start from zero. Our AWS environment follows the Well-Architected Framework, with GuardDuty, Security Hub, encryption at rest and scoped credentials in place, and we hold SOC 2 and ISO 27001 commitments to our customers. What we need is someone to own it, find the gaps, and raise the standard as the company and the threat landscape grow. YOU'LL GET A CHANCE TO 👩‍💻 👨‍💻 - Build an automated security harness. Put agents to work on our product: continuous red-team and blue-team loops that probe the agent, the platform and our code, find vulnerabilities, and propose or ship the fix. Manual review should be justified when required and automatic harness improvement is expected. - Own vulnerability management end to end. Define how we classify severity and the response time each level demands, so a critical CVE gets fixed the same day. Automate patching, dependency and image scanning, and make sure findings reach an owner and get closed. - Secure an AI agent in production. Threat-model how our agent handles untrusted documents, emails and web content, and the tools and sandboxes it uses. Design defences against prompt injection and data exfiltration, and test them. - Make security part of how we build. Review designs and changes that touch authentication, tenant isolation, secrets and data handling. Turn recurring findings into automated checks so the protection holds without depending on someone remembering. - Respond to security incidents. Lead the technical response when something goes wrong: containment, investigation and the fix. Build the technical side of our breach playbooks with our information security lead, and run the review afterwards. - Choose and run our security tooling. Evaluate and roll out a cloud security platform (such as Wiz) and the detection, alerting and logging we need across AWS and Azure. As our only product security specialist, use tooling and AI agents to cover more ground than one person could alone. - Test our defences. Run red-team exercises, manage external penetration testers, and run breach drills with engineering so everyone knows their part before it matters. - Close the loop on findings. Fix what penetration tests and security researchers report to us, run responsible disclosure, and keep the technical evidence for our SOC 2 and ISO 27001 controls current, working with our information security lead. - Make the work visible. Show leadership and engineering what the harness finds, what has been fixed and what risk remains, in plain language, with a recommendation for each open risk. YOU SHOULD APPLY IF YOU ✍️ - You build with agents. You'd rather put an agent loop on a problem than repeat a manual review. You've used AI agents to find, triage or fix security issues, and you aim for automation that leaves people to review only the exceptions. - You have deep, hands-on security engineering experience. You've owned security for a cloud-native product or platform and can do the work yourself, from reading code and IAM policies to configuring detection and running an investigation. - You know AWS security well. IAM, network design, KMS, GuardDuty, Security Hub, CloudTrail and how they fit together in a real production environment. - You've led incident response. You've run a real security incident, including containment, investigation, communication and the follow-up, and you stay clear-headed under pressure. - You take application and AI security seriously. You understand OWASP-class vulnerabilities, and you're interested in the new risks that come with LLM agents, such as prompt injection and over-broad tool access. - You understand the product and the business. You know why a finding matters to our customers and our commercial position. You can tell a theoretical finding from one that puts customer data at risk, you spend effort where the risk is real, and you don't disappear down technical rabbit holes. - You help teams ship safely. You find the secure way to do what the team needs, and you block work only when the risk justifies it. When you do, you explain why clearly enough that engineers understand and agree. - You work independently. As our first in-house product security engineer, you'll set your own priorities, build the programme, and know when to bring in outside help. - You bring people with you. You can explain a security risk to an engineer, a lawyer and a board member, adjusting the detail for each, and you change how teams work through influence rather than authority. You'll most likely come from a security engineering, product security or application security role at a fast-growing startup, or from a security consultancy with hands-on delivery. We're open to different backgrounds if you can show the depth, judgement and automation-first approach this role needs. IT WOULD ALSO BE NICE IF YOU HAVE - Experience securing LLM or agentic AI applications, or research into prompt injection and AI-specific threats. - Harness engineering experience: building the tooling, evaluation loops and guardrails that let AI agents do real engineering work. - Hands-on experience with SOC 2 and ISO 27001 audits. - Experience with Azure, Kubernetes or container security, or sandboxed code execution. - Familiarity with identity and SSO providers such as WorkOS or Okta. - Experience in legal, financial or other regulated industries. 🔒 Security is everyone’s responsibility at Orbital. We ask all team members to follow our security policies, complete regular awareness training, and handle sensitive data with care in line with ISO 27001 standards. Spot something unusual? Reporting risks or incidents quickly helps us maintain the strong culture of security and compliance we all depend on. 💡 At Orbital, we’re committed to building a diverse and inclusive team. We especially welcome applications from people who are traditionally underrepresented in tech. Even if you don’t meet every single requirement, or if the right role isn’t listed yet, we’d still love to hear from you. 💰 This hiring range is a reasonable estimate of the base pay range for this position at the time of posting. Pay is based on several factors, which may include job-related knowledge, skills, experience, and business requirements. Everyone who works with Orbital goes through background screening before they start. It's part of how we keep Orbital secure, for the people who work here and for the client information we're trusted with.