Product Security Engineer, Gecko Robotics

• Strong cloud security, software security and engineering skills
• Comfort writing code and building real-world infrastructure
• Built or fixed secure systems in production
• Worked closely with engineers (not just assess/audit/break them)
• 6+ years of experience in application security or a related role
• Bachelor’s in Computer Science, Cybersecurity, Information Technology, or a related field (or equivalent experience)
• Strong understanding of security protocols, cryptography, and application security frameworks (e.g., OWASP)
• Proficient in security testing tools (e.g., Burp Suite, OWASP ZAP) and methods
• Experience with programming languages such as Java, Python, or C++
• Familiarity with various operating systems and datastores
• Familiarity with Security Best Practices and frameworks (e.g. NIST, ISO27001, SOC 2)
• Experience with Cloud architectures and design patterns ( GCP experience is a plus)

Desirable

• We are hiring an experienced Product Security Engineer to embed security deeply into how Gecko designs, builds, deploys, and operates software
• This role goes far beyond traditional AppSec scanning or policy enforcement. You will:
• Shape Gecko’s Secure Development Lifecycle (SDL)
• Secure cloud-native architectures (AWS, GCP, Azure)
• Design and implement security and software architecture
• Act as a technical authority for all things cloud and product security
• Design, implement, and evolve Gecko’s SDL across design, build, test, deploy, and operate
• Embed security into CI/CD pipelines without slowing delivery
• Define security gates that are practical, measurable, and enforceable
• Drive remediation workflows that engineers actually complete
• Perform hands-on secure code reviews (Python, TypeScript, Cloud Formation/TerraForm, backend services)
• Identify and remediate vulnerabilities across APIs, services, auth flows, and data access
• Build and implement secure patterns (authN/Z, secrets handling, input validation, crypto usage)
• Own and operate application security tooling (SAST, DAST, dependency and secret scanning) with a focus on signal quality and developer adoption
• Secure cloud-native architectures (IAM, networking, storage, compute, CI/CD)
• Identify toxic combinations (e.g., public access + IAM misconfigurations)
• Partner with platform teams to harden baseline infrastructure
• Support container, workload identity, and service-to-service security
• Lead incident response and root cause analysis for security events
• Build and maintain automation to integrate security controls into CI/CD pipelines
• Lead threat modeling for new systems, features, and integrations
• Review system and data flow architectures for security risks
• Translate abstract threats into concrete mitigations
• Influence design decisions early — before code ships
• Partner with SOC and engineering teams to lead incident response
• Support investigations, containment, and post-incident reviews
• Help turn incidents into durable architectural improvements
• Improve logging, detection, and security telemetry over time
• Map technical controls to leading compliance frameworks (ISO 27001, SOC 2, NIST 800-53, FedRAMP, IL-4, IL-5)
• Automate audits evidence, not spreadsheets
• Ensure security controls align with real system behavior
• Enable Gecko’s expansion into regulated and mission-critical environments
• Create practical security guidance, tooling and internal documentation to scale adoption
• Deliver targeted technical training for engineers (not generic awareness)
• Act as a trusted advisor, not a blocker
• We use a variety of technologies, but we primarily operate using Python, React, and Typescript with CSPs. This is a non-exhaustive list and we are tech agnostic in our interview process, so we encourage you to apply regardless of your background