Product Security Engineer – AI Security

About the role

Cohere is looking for a Senior Product Security Engineer to protect AI‑powered products that handle highly sensitive enterprise data. You will work closely with product engineers to review architecture, perform threat modeling, test implementations, and embed security defaults into the development lifecycle.

Key responsibilities

• Lead security reviews of architecture, code, and security‑sensitive changes, identifying both individual vulnerabilities and recurring design patterns.
• Secure AI‑driven products by evaluating risks such as prompt injection, unsafe tool use, identity delegation failures, data exposure, tenant isolation, and sandbox escapes.
• Threat model new capabilities, define trust boundaries, abuse cases, and high‑impact failure modes, then translate findings into prioritized mitigations.
• Perform hands‑on testing, develop proofs of concept, assess exploitability, and partner with engineers on remediation.
• Build scalable guardrails: secure defaults, approved patterns, reusable controls, automated checks, and review requirements.
• Strengthen engineering capability by pairing with engineers, documenting guidance, and fostering durable security expertise.

Required profile

• Strong software engineering fundamentals with ability to understand, test, and fix production codebases.
• Proficiency in at least one of Python, Go, or TypeScript.
• Experience leading security reviews or threat models for complex production systems and delivering measurable design or risk improvements.
• Deep knowledge of common vulnerability classes (injection, authorization flaws, IDOR, SSRF, unsafe deserialization, race conditions, cryptographic misuse, supply‑chain risks).
• Understanding of modern application architecture: web apps, APIs, OAuth/OIDC, cloud platforms, containers, Kubernetes, CI/CD pipelines.

Required skills

• Python
• Go
• TypeScript
• Web application development
• API design and security
• OAuth / OIDC
• Cloud platforms (AWS, GCP, Azure)
• Containers and Kubernetes
• CI/CD pipelines
• Security tooling (SAST, DAST, SCA, custom linters, policy‑as‑code)

What we offer

• Weekly lunch stipend of $75 (or equivalent).
• Full health, dental, and mental‑health benefits.
• RRSP matching, 401k, pension scheme.
• 100% parental‑leave top‑up for up to 6 months.
• 6 weeks paid vacation (30 working days).
• Education stipend for conferences, courses, and coaching.
• Home office stipend and co‑working benefit for remote employees.
• Travel budget for office visits and annual company off‑site.