Senior Product Security Engineer

Who you are

• 4+ years’ experience in security-focused software engineering
• Experience working at or with a small company or a hyper-growth startup
• Demonstrated experience writing high-quality software and raising the quality bar of software engineering teams
• Demonstrated ability to identify vulnerabilities in software, e.g. through CVEs, bug bounty awards, blog posts, and prior work experience
• Open source contributions
• Experience managing cloud environments (e.g. Azure, GCP, AWS)

What the job involves

• Some of the word’s largest companies and their law firms use Harvey to make sense of their legal documents and automate legal work. Our customers depend on us to deliver a secure, trustworthy, and compliant platform. Earning the trust of our customers is a business enabler and we value it more than anything else
• As an early member of our Security team, you will you will play a key role in laying the foundation of the security and privacy of our products
• Our security program at Harvey is driven by our collective offensive security experience: Breaking into systems at other companies (in white-hat capacities), responding to real security incidents, and learning from other companies’ data breaches
• We conduct regular pentests and red team exercises with external security firms
• Closely work with engineering teams to incorporate secure design principles into engineering designs
• Review security-critical code and act as Codeowner for security-critical parts of the product, including authentication, access control, and administration
• Make well-scoped code contributions, e.g. add unit and integration tests for security controls, implement security features in collaboration with engineering teams
• Manage the security aspects of our release process
• Audit the existing codebase for vulnerabilities
• Improve our static analysis and vulnerability management tooling
• Discover vulnerabilities through red team exercises
• Participate in and drive mitigation strategies during security related incident responses