Senior Security Engineer

What you’ll do:

What we’re looking for:

Qualifications

• The Builder Mindset: Bachelor's degree in Computer Engineering or equivalent; you identify as a Software Engineer first, with a deep specialization in Security.
• Agentic Expertise: Proven experience building, testing, and deploying AI agents in production. You understand the nuances of ReAct patterns, tool-calling, and agentic memory.
• Software Mastery: Professional-grade coding skills in Python or Go. You should be comfortable building complex distributed systems, not just simple automation scripts.
• Modern AI Stack: Deep familiarity with LLM orchestration (LangChain, Semantic Kernel), Vector Databases (Pinecone, Weaviate), and LLM security frameworks.
• Cloud & Orchestration: Strong hands-on experience with AWS security services and Kubernetes, particularly in building secure, isolated environments for AI agent execution.
• Engineering DevSecOps: A track record of building security automation within CI/CD pipelines, with a shift toward autonomous "Human-in-the-loop" remediation.
• Security Domain Depth: While we prioritize building, you must have a solid foundation in data protection (encryption/KMIP) and identity (OIDC, OAuth 2.0).
• Prompt Engineering as Logic: Ability to design robust, version-controlled prompts that treat AI reasoning as a predictable, testable engineering component. Communication: The ability to explain "Agentic Thinking" to cross-functional teams and negotiate the balance between autonomous action and system stability.

Responsibilities

• At Procore, AI isn’t a specialized tool, it's a core competency. We expect every team member to be AI-literate, leveraging generative tools and agentic workflows to move faster and work smarter. You won’t just use AI; you’ll be building the agentic future of construction.
• Build Autonomous Defenders: Design and deploy security agents using frameworks like LangChain, CrewAI, or AutoGPT to automate complex security reasoning tasks.
• Architect Agentic IAM: Build autonomous guardrails for cloud (AWS) and corporate environments that dynamically adjust permissions based on agentic analysis of risk telemetry.
• Agentic SDLC Integration: Construct automated pipelines where AI agents perform continuous threat modeling, code analysis, and auto-generate PRs for vulnerability remediation.
• Secure the AI Lifecycle: Develop and implement security controls for our internal AI agents, including Prompt Injection mitigation, RAG security, and sandboxed execution environments.
• Self-Healing Infrastructure: Develop "paved road" libraries and autonomous agents that monitor and fix drift in containerized (Kubernetes, EKS) and IaC (Terraform) workflows.
• Autonomous Asset Intelligence: Build agentic workflows for real-time asset discovery and automated SBOM generation that adapts as our ecosystem evolves.
• Lead the Technical Roadmap: Contribute to the vision of "Agentic SecEng," moving the organization from manual dashboards to autonomous response.
• Mentor & Code Review: Review agent logic, prompt templates, and traditional code, mentoring junior engineers in the transition from security analysts to security builders.
• What we’re looking for:
• The Builder Mindset: Bachelor's degree in Computer Engineering or equivalent; you identify as a Software Engineer first, with a deep specialization in Security.
• Agentic Expertise: Proven experience building, testing, and deploying AI agents in production. You understand the nuances of ReAct patterns, tool-calling, and agentic memory.
• Software Mastery: Professional-grade coding skills in Python or Go. You should be comfortable building complex distributed systems, not just simple automation scripts.
• Modern AI Stack: Deep familiarity with LLM orchestration (LangChain, Semantic Kernel), Vector Databases (Pinecone, Weaviate), and LLM security frameworks.
• Cloud & Orchestration: Strong hands-on experience with AWS security services and Kubernetes, particularly in building secure, isolated environments for AI agent execution.
• Engineering DevSecOps: A track record of building security automation within CI/CD pipelines, with a shift toward autonomous "Human-in-the-loop" remediation.
• Security Domain Depth: While we prioritize building, you must have a solid foundation in data protection (encryption/KMIP) and identity (OIDC, OAuth 2.0).
• Prompt Engineering as Logic: Ability to design robust, version-controlled prompts that treat AI reasoning as a predictable, testable engineering component. Communication: The ability to explain "Agentic Thinking" to cross-functional teams and negotiate the balance between autonomous action and system stability.