Director, Product Security
CoreWeave · Livingston, NJ / New York, NY / Sunnyvale, CA / Bellevue, WA
About this role
**Director, Product Security** **About CoreWeave** CoreWeave is The Essential Cloud for AI™—built for pioneers by pioneers. We deliver a platform of technology, tools, and teams that enables innovators to build and scale AI with confidence. Trusted by leading AI labs, startups, and global enterprises, CoreWeave combines superior infrastructure performance with deep technical expertise to accelerate breakthroughs and turn compute into capability. **About the Team** The Product Security team ensures everything we ship—and everything we use to build it—is secure by design. The team owns application security, vulnerability management, offensive security, AI product security, and product vulnerability response across CoreWeave. We partner closely with Product, Engineering, and Security Foundations. CoreWeave is seeking a **Director of Product Security** to lead this highly technical organization. This role focuses on building security that runs at machine speed: threat models at design time, reviewed before merge, and continuously attacked by internal agents before adversaries can exploit weaknesses. --- ## Key Responsibilities - Define and drive the **Product Security strategy and roadmap** across application security, vulnerability management, offensive security, AI product security, and product vulnerability response. - Lead and grow a **multi-team organization** of managers and senior ICs (including hiring engineering managers for each function). - Build an **agentic-first vulnerability program** that discovers, triages, and remediates issues at scale—retiring entire classes of risk. - Own **vulnerability management end to end** (discovery, prioritization, SLAs, remediation, and executive reporting). - Run a **tiered offensive security program** combining continuous agentic testing, third-party assessments, internal focus on hardest targets, and external researchers via vulnerability disclosure and bug bounty programs. - Apply offensive security to **tenant isolation** across shared GPUs, bare metal, and Kubernetes (ensuring isolation controls hold). - Build a **“paved road”** for engineers: secure defaults, controls integrated into existing workflows, and validated findings with fixes attached. - Establish a unified **secure development lifecycle** (threat modeling, secure design review, security tooling in CI/CD) and extend it to acquired companies. - Own security for **CoreWeave AI products** and the AI tooling engineers build (model/dataset supply chain, agent tooling, provenance of AI-generated code). - Stand up and run **PSIRT** (product vulnerability response): intake, coordinated disclosure, customer communication, and fixes. - Embed Product Security Partners in critical product areas with authority to make design-time security decisions within policy; maintain a leadership cadence with Product Management. - Partner with Cloud Security, Platform Security, Detection & Response, and GRC to keep prevent/detect/respond boundaries clear. --- ## Qualifications - **10+ years** in security or software engineering, with significant experience in application security, vulnerability management, or offensive security. - **5+ years** security leadership experience, including managing managers and scaling multi-team organizations. - Proven track record building/running a **product security program** at a cloud provider, security company, or large-scale SaaS business. - Experience taking over existing teams and integrating them into one
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.