Product Security Engineer

Founded in 2022 and headquartered in Seattle, Washington, Overland AI is transforming land operations for modern defense. The company leverages over a decade of advanced research in robotics and machine learning, as well as a field‑test forward ethos, to deliver combined capabilities for unit commanders. Our Over Drive autonomy stack enables ground vehicles to navigate and operate off‑road in any terrain without GPS or direct operator control.

Our intuitive Over Watch C2 interface provides commanders with precise coordination capabilities essential for mission success.

Overland AI has secured funding from prominent defense tech investors including 8VC and Point 72, and built trusted partnerships with DARPA, the U.S. Army, Marine Corps, and Special Operations Command. Backed by eight‑figure contracts across the Department of Defense, we are strengthening national security by iterating closely with end users engaged in tactical operations.

We are looking for a mission‑driven Product Security Engineer to embed security into the entire lifecycle of our cutting‑edge robotic systems and our command and control system. You will be responsible for hardening our autonomous ground vehicles against cyber threats in complex, contested environments. You will own compliance with our customer's contract requirements for cyber security.

You'll embed with engineering teams to drive threat modeling, define security requirements, prioritize risk, and verify that controls meet contractual and regulatory standards. You'll own our compliance posture (CSEIG v3.0, NIST 800‑53/171, DISA STIGs) and prepare the evidence and documentation needed for customer authorization (ATO/ATC). You'll be the person who translates customer security requirements and industry standards into clear, prioritized work that engineering teams can act on.

This is a strategic and analytical role with technical depth. You need to understand how attacks work against embedded systems, networked robots, and C2 architectures, but your primary output is requirements, threat models, verification plans, and compliance artifacts, not production code.

• Security strategy & prioritization:
  Set and own the security roadmap. Assess the current posture, identify the highest‑risk gaps, and sequence the work so the most important things get done first. You won't be able to fix everything at once — knowing what matters most is the job.
• Threat modeling & risk analysis:
  Lead threat modeling and attack‑tree exercises across our robotic, autonomy, and C2 systems. Analyze operational concepts to identify security implications. Drive risk assessments that weigh mitigations against mission needs and resource constraints.
• Security requirements:
  Translate customer contracts, regulatory standards, and operational threat context into actionable security requirements for engineering teams. Define security acceptance criteria for features and releases. When an engineer asks why a control matters, explain the threat and the mission rationale.
• Compliance & authorization:
  Own the RMF and ATO/ATC lifecycle from control selection and tailoring through evidence generation and government stakeholder coordination. Map and implement controls aligned with CSEIG v3.0, DISA STIGs, and NIST 800‑53/171. Prepare documentation and evidence packages. Manage POA&Ms. Track compliance gaps and drive closure with engineering. You are the company's ATO authority.
• Secure development lifecycle:
  Drive security across design, code review, CI/CD, and release. Establish security gates and review checklists. Participate in software release decisions as the security authority. Partner on supply‑chain security, SBOM generation, and vulnerability…