Senior Product Security Engineer

At Anyscale, we're on a mission to democratize distributed computing and make it accessible to software developers of all skill levels. We’re commercializing Ray, a popular open-source project that's creating an ecosystem of libraries for scalable machine learning. Companies like OpenAI, Uber, Spotify, Instacart, Cruise, and many more, have Ray in their tech stacks to accelerate the progress of AI applications out into the real world.

With Anyscale, we’re building the best place to run Ray, so that any developer or data scientist can scale an ML application from their laptop to the cluster without needing to be a distributed systems expert.

Proud to be backed by Andreessen Horowitz, NEA, and Addition with $250+ million raised to date.

About the Role

Anyscale’s product security needs are growing as we ship to larger and more demanding customers. We’re looking for a Senior Product Security Engineer to own our secure software development lifecycle and to be engineering’s partner on building security into the product. Reporting to the Head of Security, you will work in close partnership with engineering.

This is a senior, high-ownership role. You will own and operate a scalable SSDL, partner with engineering on security features and secure design, review the security of existing systems and new initiatives, and own how we find, track, drive to resolution and report on vulnerabilities in what we ship. This is a product security role with platform depth, not a cloud security role. This role is based in India.

In your first year, success looks like an SSDL that scales with engineering rather than gating it, including how we build with AI coding agents, security review embedded in how new initiatives ship, and accurate, on-demand vulnerability reporting backed by a working path to resolution.

What You’ll Do

• Own and operate a scalable secure software development lifecycle: threat modeling, security requirements, secure design practices, and scanning that engineering can readily adopt.

• Define how our SSDL works when AI writes and ships code: guardrails, review, and scanning for coding agents, MCP integrations, and LLM-powered features.

• Partner with engineering on security features and secure-by-design architecture, from early design through implementation.

• Extend product security down to the platform it runs on: cloud IAM and service roles, Kubernetes and container security, and service-to-service trust on the path to customer data.

• Review the security of existing systems and new initiatives, and turn findings into prioritized, actionable work.

• Own vulnerability management for what we ship: enumerate components, map known vulnerabilities, and produce accurate posture reporting on demand.