Senior Product Security Engineer

Why HarveyAt Harvey, we’re transforming how legal and professional services operate. By combining frontier agentic AI, an enterprise-grade platform, and deep domain expertise, we’re reshaping how critical knowledge work gets done for decades to come.This is a rare chance to help build a generational company at a true inflection point. We have strong product-market fit and world-class investor support. We’re scaling fast and defining a new category in real time. The work is ambitious, the bar is high, and the opportunity for growth — personal, professional, and financial — is unmatched.Our team moves fast, takes ownership, and is deeply committed to the mission — operating with intensity, staying close to our customers, and pushing each other for excellence. We live by three values: Decisiveness, Simplicity, and Job's Not Finished. We act quickly on clear judgment over perfect information, we believe simplicity is what scales, and we're never satisfied with where we are. If you want to do the best work of your career alongside people who share that drive, we'd love to build with you.At Harvey, the future of professional services is being written today — and we’re just getting started.RoleSome of the word’s largest companies and their law firms use Harvey to make sense of their legal documents and automate legal work. Our customers depend on us to deliver a secure, trustworthy, and compliant platform. Earning the trust of our customers is a business enabler and we value it more than anything else.As an early member of our Security team, you will you will play a key role in laying the foundation of the security and privacy of our products.Our security program at Harvey is driven by our collective offensive security experience: Breaking into systems at other companies (in white-hat capacities), responding to real security incidents, and learning from other companies’ data breaches. We conduct regular pentests and red team exercises with external security firms.ResponsibilitiesClosely work with engineering teams to incorporate secure design principles into engineering designs.Review security-critical code and act as Codeowner for security-critical parts of the product, including authentication, access control, and administration.Make well-scoped code contributions, e.g. add unit and integration tests for security controls, implement security features in collaboration with engineering teams.Manage the security aspects of our release process.Audit the existing codebase for vulnerabilities.Improve our static analysis and vulnerability management tooling.Discover vulnerabilities through red team exercises.Participate in and drive mitigation strategies during security related incident responses.Qualifications4+ years’ experience in security-focused software engineering.Experience working at or with a small company or a hyper-growth startup.Demonstrated experience writing high-quality software and raising the quality bar of software engineering teams.Demonstrated ability to identify vulnerabilities in software, e.g. through CVEs, bug bounty awards, blog posts, and prior work experience.BonusOpen source contributions.Experience managing cloud environments (e.g. Azure, GCP, AWS)CompensationIn consideration of market analysis and relevant factors, the salary range for this position is set between $200,000 and $280,000. However, adjustments outside of this range may be considered for candidates whose qualifications significantly differ from those outlined in the job description. Additionally, this role is eligible to participate in our equity plan and benefits program. Benefits include, but not limited to: Comprehensive health, dental and vision coverage, retirement benefits (401k match up to 4%), and flexible PTO.Depending on your location, an