Product Security Engineer

THE OPPORTUNITY

Apollo Research works with most frontier AI companies (OpenAI, Anthropic, Google, Meta, Thinking Machines and others) to test their models before deployment and collaborate on fundamental scheming research. Our coding agent security product, Watcher, is deployed in production and monitors billions of agent tokens per month across engineering teams at agent‑building scale‑ups and enterprises.

We’re hiring a Product Security Engineer to make Watcher safe to deploy  will own the day to day of Watcher’s security posture, from product security standards to the security conversations with our customers. You will work closely with the internal Infra & Security team who owns Apollo’s overall security roadmap and priorities.

Security Engineering & Operations

• Design, build, and operate Watcher’s core security controls: identity and access management, infrastructure and cloud security, endpoint management, and incident response.

• Build paved roads that make the secure path the default, easy path

• Establish and advocate for security practices across Apollo, and build the organizational trust needed for people to adopt them, communicating security decisions and tradeoffs clearly along the way.

• Evaluate vendors and tooling, make build‑vs‑buy calls on security infrastructure, and assess vendor security posture before adoption.

• Lead major security projects end to end, from ideation through implementation and rollout.

• Own security questionnaire responses, product security whitepapers, and support for customer pen‑tests.

• Own the technical content of customer‑facing communications during incidents.

• Collaboratively define and shape Watcher’s security roadmap and priorities with the Apollo Infrastructure & Security team

Support Product Strategy

• Join customer/prospect calls to understand security needs firsthand, and map them onto the AI Security & Control Researcher's threat models and failure mode library.

• Maintain awareness of how enterprises currently secure coding agents (or don't), what tools they use (SIEM, DLP, CSPM), and how Watcher fits into their existing stack.

• Understand which failure modes are the biggest problems for security buyers, and prioritize systematically what's most useful to solve; feeding that buyer signal into the AI Security & Control Researcher's failure mode prioritization.

Must-haves

• 5+ years in security roles in a hands‑on technical capacity (not purely GRC/compliance). Able to read code, understand infrastructure, and evaluate technical controls, not just write policies.

• Engineering mindset
  : you treat security as an engineering problem, capable of building custom solutions rather than gluing together off‑the‑shelf tools. You prioritize automation and systems‑level thinking, and are comfortable leveraging AI to accelerate development.

• Direct experience with application security, cloud security, or product security
  . ideally having owned or significantly contributed to the security posture of a product handling sensitive customer data.

• Experience in a security vendor or security product company. Building security products is different from consuming them, and someone who has done both will bridge the gap between “what CISOs want” and “what we can actually build” more effectively.

• Comfortable working in a small, fast‑moving team, context‑switching between hands‑on security work and strategic product thinking within the same week.

• Strong written communication, this role produces security questionnaire responses, whitepapers, and incident communications that need to be clear and precise.

Nice‑to‑haves

• Strong understanding of enterprise security buyer concerns
  , ideally from having been a security engineer or leader at an organization that buys security tooling, or from working closely enough with those buyers to internalize their priorities.

• Experience with incident response, specifically leading a real security incident through to resolution and customer communication.

• Experience with AI/ML systems security or LLM security.

• Design a security roadmap for keeping Watcher's customer data secure: Watcher runs on top of coding agents and…