Product Security Engineer, Harvey

• 5+ years experience in Security Engineering, Software Engineering, or Site Reliability Engineering roles
• Demonstrated experience writing high-quality software and building production-grade infrastructure and raising the quality bar of engineering teams
• Strong fundamentals in networking, operating systems, and cryptographic protocols
• In-depth knowledge of Kubernetes, common misconfigurations, and privilege escalation vectors
• Demonstrated ability to find weaknesses (e.g. privilege escalation) in real-world cloud environments
• Experience applying security best practices in cloud environments (AWS, Azure, or Google Cloud)
• (No experience with generative AI or legal required)

Desirable

• As an Infrastructure Security Engineer, you’ll design and build secure-by-default infrastructure that product teams can rely on
• This includes designing and implementing processes and technologies for least privilege, isolating different components, managing attack surface, and implementing layers of tenant isolation on our multi-tenant SaaS offering
• You’ll also create frameworks and repeatable patterns that enable our research and engineering teams to move quickly and independently—without sacrificing security
• Our security program at Harvey is driven by our collective offensive security experience: breaking into systems at other companies (in white-hat capacities), responding to real security incidents, and learning from other companies’ data breaches
• We regularly conduct penetration tests and red team exercises. At the same time, we are all software engineers - contributing code daily and approaching security with an engineering-first mindset
• Incorporate secure design principles into our cloud architecture
• Develop isolation mechanisms (e.g. sandboxing) in collaboration with our product engineering team
• Review security-critical configuration changes and act as Codeowner for security-critical parts of our cloud configurations (everything is IaC)
• Audit our existing cloud environment for vulnerabilities
• Develop policies and procedures for the secure creation and operation of our cloud environments