Security Engineer – Product Security

This is a fully remote position, open to applicants in United States, +2 more locations.

📋 Description

• Develop and enhance agentic AI workflows that transform security vulnerability findings into well-tested, review-ready code modifications for engineering teams at Spotify.

• Create and implement evaluation frameworks to assess the quality of automated fixes, focusing on aspects such as correctness, completeness, safety, build and test success, and pull request merge rates.

• Design tools and processes to compare different remediation strategies, assess AI models, and enhance the reliability and effectiveness of generated fixes.

• Investigate and apply cutting-edge practices in AI-assisted vulnerability remediation, including prompt engineering, context engineering, and providing vulnerability-specific fix guidance.

• Identify vulnerability types that are amenable to automated remediation, while considering security impact, technical feasibility, and the developer experience.

• Work collaboratively with developers and security stakeholders to gather feedback through code reviews, pull requests, support channels, and interactive sessions.

• Create scalable solutions that mitigate security risks and facilitate easier resolution of vulnerabilities for teams.

• Contribute to defining Spotify's approach to managing security posture.

⛳️ Requirements

• Demonstrated experience in software engineering, especially in security engineering, developer experience, or internal infrastructure.

• Proficient in reading, understanding, and writing code in one or more of the following languages: Java, Python, Scala, C++, or TypeScript.

• Proven experience in designing and building scalable systems.

• Solid understanding of software architecture and reliable engineering practices.

• Familiarity with agentic AI systems or AI-assisted development workflows.

• Knowledge of common security risks, attack vectors, and vulnerabilities, including those relevant to AI and machine learning systems, along with strategies for their mitigation.

• Experience in integrating security tools or automated workflows into production engineering settings.

• Awareness of agentic AI frameworks and methods for assessing the quality, reliability, and safety of AI-generated outputs.

• Comfortable working collaboratively across teams, learning from feedback, navigating uncertainty, and balancing innovation with informed security choices.

• Availability to work within the EST time zone.

🏝️ Benefits

• Equal opportunity employer.

• Reasonable accommodations available during the interview and application process.

• Accessibility support provided throughout the recruitment process.