Senior Product Security Engineer

- Own and operate a scalable secure software development lifecycle: threat modeling, security requirements, secure design practices, and scanning that engineering can readily adopt. - Partner with engineering on security features and secure-by-design architecture, from early design through implementation. - Review the security of existing systems and new initiatives, and turn findings into prioritized, actionable work. - Own vulnerability management for what we ship: enumerate components, map known vulnerabilities, and produce accurate posture reporting on demand. - Drive vulnerabilities to resolution with engineering against defined SLAs. - Own software composition analysis, secret scanning, and SAST across product repositories, and set the bar for secure-development checks. - Mentor other engineers and raise the security bar across the organization.

- 8+ years in product or application security, with senior-level depth, ideally at a high-growth startup. - Demonstrated ownership of a secure software development lifecycle at scale, including threat modeling and secure design review. - A strong hands-on background partnering with engineering on security features and architecture, not just reporting findings. - Deep experience with software composition analysis, secret scanning, and SAST or secure-development tooling in real repositories. - A solid understanding of software supply chain security and how to enumerate what an organization ships, including SBOM approaches. - Experience triaging vulnerabilities using CVSS and business context and driving them to resolution with engineering. - The communication and seniority to set direction, review others' work, and raise the bar for those around you.

At Anyscale https://www.anyscale.com/, we're on a mission to democratize distributed computing and make it accessible to software developers of all skill levels. We’re commercializing Ray https://docs.ray.io/en/latest/, a popular open-source project that's creating an ecosystem of libraries for scalable machine learning. Companies like OpenAI https://thenewstack.io/how-ray-a-distributed-ai-framework-helps-power-chatgpt/, Uber https://www.uber.com/blog/horovod-ray/, Spotify https://engineering.atspotify.com/2023/02/unleashing-ml-innovation-at-spotify-with-ray/, Instacart https://www.youtube.com/watch?v=3t26ucTy0Rs&list=PLzTswPQNepXmLUiL4F_1VHrPcCz1OeILw&index=23&pp=iAQB, Cruise https://www.youtube.com/watch?v=gj0BqvfX_wI&list=PLzTswPQNepXmLUiL4F_1VHrPcCz1OeILw&index=46&pp=iAQB, and many more, have Ray in their tech stacks to accelerate the progress of AI applications out into the real world. With Anyscale, we’re building the best place to run Ray, so that any developer or data scientist can scale an ML application from their laptop to the cluster without needing to be a distributed systems expert. Proud to be backed by Andreessen Horowitz, NEA, and Addition https://www.wsj.com/articles/ai-startup-anyscale-adds-99-million-to-andressen-horowitz-led-funding-round-11661254200 with $250+ million raised to date. ABOUT THE ROLE Anyscale's product security needs are growing as we ship to larger and more demanding customers. We're looking for a Senior Product Security Engineer to own our secure software development lifecycle and to be engineering's partner on building security into the product. Reporting to the Head of Security, you will work in close partnership with engineering. This is a senior, high-ownership role. You will own and operate a scalable SSDL, partner with engineering on security features and secure design, review the security of existing systems and new initiatives, and own how we find, track, drive to resolution and report on vulnerabilities in what we ship. This role is based in India. In your first year, success looks like an SSDL that scales with engineering rather than gating it, security review embedded in how new initiatives ship, and accurate, on-demand vulnerability reporting backed by a working path to resolution. WHAT YOU'LL DO - Own and operate a scalable secure software development lifecycle: threat modeling, security requirements, secure design practices, and scanning that engineering can readily adopt. - Partner with engineering on security features and secure-by-design architecture, from early design through implementation. - Review the security of existing systems and new initiatives, and turn findings into prioritized, actionable work. - Own vulnerability management for what we ship: enumerate components, map known vulnerabilities, and produce accurate posture reporting on demand. - Drive vulnerabilities to resolution with engineering against defined SLAs. - Own software composition analysis, secret scanning, and SAST across product repositories, and set the bar for secure-development checks. - Mentor other engineers and raise the security bar across the organization. WHAT YOU'LL BRING - 8+ years in product or application security, with senior-level depth, ideally at a high-growth startup. - Demonstrated ownership of a secure software development lifecycle at scale, including threat modeling and secure design review. - A strong hands-on background partnering with engineering on security features and architecture, not just reporting findings. - Deep experience with software composition analysis, secret scanning, and SAST or secure-development tooling in real repositories. - A solid understanding of software supply chain security and how to enumerate what an organization ships, including SBOM approaches. - Experience triaging vulnerabilities using CVSS and business context and driving them to resolution with engineering. - The communication and seniority to set direction, review others' work, and raise the bar for those around you. NICE TO HAVE - Experience producing vulnerability or security posture reporting for enterprise or regulated customers. - Familiarity with container artifact security, including image scanning, signing, and SBOM generation. - Experience building or maturing an SSDL program at scale. - Background in AI or ML platforms or distributed systems. WHY ANYSCALE - We're on a mission to make scalable computing effortless. Ray is the AI Compute Engine at the center of some of the world's most powerful AI platforms - Our tech is in production at companies like OpenAI, Uber, Spotify, Instacart, and Cruise - We're backed by Andreessen Horowitz, NEA, and Addition, with $250M+ raised to date - Recent partnerships with Azure, CoreWeave, and Google Cloud are putting AI-native compute directly into enterprise environments - Competitive salary and equity, plus health/dental/vision coverage (many plans up to 99% employer-covered) - We offer flexible time off, paid parental leave, and mental health support Anyscale Inc. is an Equal Opportunity Employer. Candidates are evaluated without regard to age, race, color, religion, sex, disability, national origin, sexual orientation, veteran status, or any other characteristic protected by federal or state law.   Anyscale Inc. is an E-Verify company and you may review the Notice of E-Verify Participation https://drive.google.com/file/d/1Kt2S6_k_SjxaEdGowH4rngVdg2ApAQV3/view?usp=sharing and the Right to Work posters in English and Spanish https://drive.google.com/file/d/1K3Nz72xgsU2hngnVUEu53wEeZjbAMbnZ/view?usp=sharing