Role overview

Cohere is a security-first enterprise AI company that builds foundation models and end-to-end products for organizations deploying AI systems at scale. This Senior Product Security Engineer role is a hands-on engineering position focused on securing AI-powered products and the sensitive data enterprises entrust to the platform. You will work directly alongside product and engineering teams to identify and mitigate security risks unique to AI systems.

Key responsibilities

Conduct security reviews of architecture, code, and security-sensitive changes to identify individual vulnerabilities and underlying design patterns that create recurring risks.
Evaluate security risks specific to AI-powered products, including prompt injection, unsafe tool use, identity and delegation failures, excessive agency, data exposure, tenant isolation, and sandbox escapes.
Perform threat modeling for new capabilities by identifying trust boundaries, abuse cases, and high-impact failure modes before implementation and translating findings into practical, prioritized mitigations.
Execute hands-on testing to investigate suspected vulnerabilities, develop proofs of concept, assess exploitability and impact, and work with engineers through remediation.
Design and build scalable security controls including secure defaults, approved patterns, reusable guardrails, and automated checks that reduce recurring risks across teams.
Strengthen engineering security capabilities by pairing with engineers, documenting practical guidance, and helping product teams develop lasting security expertise.
Communicate technical security findings, business impact, and remediation options clearly to engineers, product leaders, and executives to influence risk decisions.

Requirements

Strong software engineering fundamentals with the ability to independently understand, test, and contribute fixes to production codebases.
Proficiency in at least one of Python, Go, or TypeScript.
Demonstrated experience leading security reviews or threat models for complex production systems with documented design or risk improvements.
Understanding of common vulnerability classes and their underlying design failures, including injection, authorization flaws, IDOR, SSRF, unsafe deserialization, race conditions, cryptographic misuse, and software supply-chain risks.
Knowledge of modern application architecture including web applications, APIs, OAuth/OIDC, cloud platforms, containers, Kubernetes, and CI/CD systems.
Ability to reason rigorously about untrusted input, authorization, isolation, identity, delegation, and data boundaries.
Track record of driving security improvements across multiple engineering teams using influence and leadership.

What makes this role worth considering

Cohere operates globally with offices in Toronto, London, New York City, San Francisco, Montreal, Paris, Berlin, and Seoul, offering flexibility for remote work or office-based arrangements. The company provides comprehensive benefits including six weeks of paid vacation, full health and dental coverage, parental leave support, education and learning stipends, and a home office setup budget of $500.