Senior Product Security Engineer

About this job

Anyscale is on a mission to democratize distributed computing by commercializing Ray, an open-source project that creates an ecosystem for scalable machine learning. Used by prominent companies like OpenAI, Uber, Spotify, and Cruise, Anyscale builds platforms that allow developers and data scientists to scale machine learning applications easily. As product security needs grow, the company is seeking a Senior Product Security Engineer in Bengaluru to own the secure software development lifecycle (SSDL). In this role, you will work closely with the engineering team, report to the Head of Security, and serve as an engineering partner for building secure systems. A normal day involves designing scalable SSDL practices, conducting threat modeling, reviewing the security of current and upcoming initiatives, managing software composition analysis and vulnerability scanning, partnering on secure architectures, and driving vulnerabilities to resolution against defined SLAs.

Responsibilities

• Own and operate a scalable secure software development lifecycle including threat modeling and secure design practices.
• Partner with engineering teams on security features and secure-by-design architecture from early design to implementation.
• Review security across existing systems and new initiatives to turn findings into actionable work.
• Manage vulnerability tracking, component enumeration, posture reporting, and drive resolutions using SLAs.
• Operate software composition analysis, secret scanning, and SAST across product repositories.
• Mentor other engineers and elevate the overall security posture across the organization.

Requirements

• 8+ years of professional experience in product or application security with senior-level depth.
• Demonstrated ownership of a secure software development lifecycle at scale including threat modeling.
• Hands-on background partnering with engineering on security features and system architecture.
• Experience with software composition analysis, secret scanning, and SAST or secure-development tools.
• Understanding of software supply chain security, SBOM approaches, and asset enumeration.
• Experience triaging vulnerabilities with CVSS and business context to drive resolutions.

Good to have

• Experience producing vulnerability or security posture reports for enterprise or regulated customers.
• Familiarity with container artifact security including image scanning, signing, and SBOM generation.
• Experience building or maturing an SSDL program at scale.
• Background working in AI, ML platforms, or distributed systems.

Who should apply

This role suits experienced security professionals with extensive backgrounds in product or application security, particularly those who have worked in high-growth startups and possess strong engineering collaboration skills. Candidates should have deep knowledge of SSDL, vulnerability management, and secure software development tools. This is a senior position requiring at least 8 years of experience, so it is not suitable for freshers.

Frequently asked questions