Product Security Engineer

About Emergence AI

Emergence AI is a frontier agentic AI lab advancing safe, autonomous AI through its pioneering neuroformal architecture. We are building the next generation of enterprise AI: systems capable of understanding complex knowledge, reasoning across information, executing multi-step workflows, and taking action with the verifiability and reliability required for mission-critical environments.

Our Enterprise Agent Platform provides the foundation for building, deploying, and operating AI systems in production — from data connectivity and knowledge management to workflow orchestration, observability, evaluation, and governance. We partner with organizations in semiconductor manufacturing, life sciences, and other data-intensive industries to solve complex challenges that require trusted AI systems capable of operating in real-world environments.

Our team brings experience from leading AI research labs and technology companies, including IBM Research, The Allen Institute for AI, Amazon, and Broadcom. With headquarters in New York and offices across California, Spain, and India, we bring together diverse expertise and perspectives to tackle some of the most challenging problems in enterprise AI.

About the Role

Emergence AI is building the future of enterprise automation through autonomous agent orchestration. As we scale our platform and deepen relationships with enterprise customers, security is not a function that runs alongside the product — it is part of the product.  We are looking for a Product Security Engineer to join our small, high-impact IT Security team. Reporting to the CISO, you will be embedded with engineering to own the security of our agentic AI platform — from threat modeling new agent capabilities to identifying and remediating risk across our multi-agent workflows. This is a role for someone who thinks deeply about novel attack surfaces, communicates clearly with both technical and non-technical stakeholders, and wants to help define what security looks like in the agentic AI era. 

You'll

• Product-Embedded Security 

  • Perform threat modeling and secure design reviews for new agent capabilities, including tool use, memory systems, and multi-agent orchestration flows 
  • Identify and remediate security risks in agentic workflows — prompt injection, privilege escalation across agents, unauthorized tool invocation, and trust boundary violations 
  • Partner with engineering as an embedded security partner during design, development, and release cycles — not as a gatekeeper, but as a collaborator 
  • Define and maintain secure development standards and patterns specific to LLM-based and agentic systems 

• Vulnerability Research & Risk Management 

  • Research emerging attack surfaces relevant to AI agent platforms and translate findings into actionable mitigations 
  • Lead security assessments of internal tools, third-party integrations, and open source dependencies 
  • Contribute to supply chain security controls including dependency pinning, SBOM management, and CI/CD hardening 
  • Support incident response investigations with a focus on agent and application-layer events 

• Team & Customer-Facing Responsibilities 

  • Support enterprise customer security reviews and trust conversations related to agent security posture 
  • Contribute to SOC 2 Type II evidence collection and control maintenance alongside the broader ITSEC team 
  • Collaborate with the DevSecOps Engineer on security tooling, pipeline controls, and infrastructure security 
  • Produce clear written documentation — risk assessments, security advisories, runbooks — that can be shared internally and externally 

You'll Have

• 5–8 years of experience in application security, product security, or a closely related security engineering discipline
• Hands-on experience with threat modeling methodologies (STRIDE, PASTA, or equivalent) 
• Strong background in secure SDLC practices and AppSec tooling (SAST, DAST, SCA)
• Familiarity with cloud-native environments — Kubernetes, containerized workloads, and CI/CD pipelines 
• Experience conducting security assessments of APIs, microservices, and third-party integrations 
• Excellent written communication — you can produce a security advisory or risk assessment that engineers and executives can both act on 

Bonus Points

• Demonstrated interest or experience in AI/ML system security — you have thought about prompt injection, model behavior, or LLM attack surfaces
• Familiarity with agentic AI concepts: tool use, memory, multi-agent coordination, or autonomous workflow execution
• Experience with supply chain security controls: SLSA, SBOM, dependency pinning, OIDC-based signing
• Prior exposure to SOC 2, ISO 27001, or similar compliance frameworks
• Experience supporting enterprise security reviews or contributing to customer-facing trust content