产品安全工程师，北区安全
Product Security Engineer, North Security
我们是谁？
Cohere 是一家以安全为首要任务的企业人工智能公司。我们构建前沿的基础人工智能模型和端到端产品，旨在解决现实世界中的业务问题。
我们正在为正在构建人工智能系统的公司训练和部署前沿模型。我们认为我们的工作对人工智能的广泛应用至关重要，我们正在寻找希望参与其中的人才。
我们对所构建的产品精益求精。我们每个人都负责提升模型的能力以及为客户创造的价值。Cohere 是一个由研究人员、工程师、设计师等组成的团队，大家对各自的专业充满热情。
我们是一家总部位于多伦多的全球科技公司，在伦敦、纽约市、旧金山、蒙特利尔、巴黎、柏林和首尔设有主要办公室。加入我们！
为什么选择这个职位
企业将最敏感的数据交给 Cohere，并将我们的模型嵌入到他们无法出错的工作流程中。确保安全性意味着要解决行业尚未解决的问题，例如代理代表用户行动时的授权含义、如何限制消耗不可信输入的工具，以及当模型可以被其读取的数据引导时，租户边界是否有效。既定的指南只能带你走到这里。
我们正在招聘一名高级产品安全工程师，与正在构建产品的工程师一起解决这些问题，审查架构和代码，进行威胁建模，测试即将发布的内容，并将你学到的经验转化为其他团队可继承的默认设置。这是一个动手的工程角色，而不是咨询性质的。
你将负责
- 主导安全审查。审查架构、代码和安全敏感的变更。识别个别漏洞以及它们背后重复的设计模式。
- 保障人工智能驱动的产品。评估风险，如提示注入、不安全的工具使用、身份和委托失败、过度自主性、数据泄露、租户隔离和沙箱逃逸。
- 对新功能进行威胁建模。在实现之前识别信任边界、滥用案例和高影响的故障模式。将发现转化为实际且优先级明确的缓解措施。
- 进行实际测试。调查可疑的漏洞，开发概念验证，评估可利用性和影响，并与工程师合作进行修复。
- 构建可扩展的防护机制。开发安全默认设置、批准的模式、可重用的控制措施、权限管理策略、审计日志系统和自动化检测工具。
查看英文原文
Who are we?
Cohere is the leading security-first enterprise AI company. We build cutting-edge foundation AI models and end-to-end products that are designed to solve real-world business problems.
We’re training and deploying frontier models for enterprises who are building AI systems. We believe that our work is instrumental to the widespread adoption of AI and we are looking for folks that want to be part of that.
We obsess over what we build. Each one of us is responsible for contributing to increasing the capabilities of our models and the value they drive for our customers. Cohere is a team of researchers, engineers, designers, and more, who are all passionate about their craft.
We are a global technology company headquartered in Toronto with key offices in London, New York City, San Francisco, Montreal, Paris, Berlin and Seoul. Join us!
WHY THIS ROLE
Enterprises hand Cohere their most sensitive data and put our models inside workflows they can't afford to get wrong. Securing that means working on problems the industry hasn't settled yet, what authorization means when an agent acts on a user's behalf, how to contain tools that consume untrusted input, and whether tenant boundaries hold when a model can be steered by the data it reads. The established playbooks only take you so far.
We're hiring a Senior Product Security Engineer to work these problems alongside the engineers building the products, reviewing architecture and code, threat modeling before implementation, testing what ships, and turning what you learn into defaults other teams inherit. This is a hands-on engineering role, not an advisory one.
WHAT YOU’LL DO
- Lead security reviews. Review architecture, code, and security-sensitive changes. Identify both individual vulnerabilities and the recurring design patterns behind them.
- Secure AI-powered products. Evaluate risks such as prompt injection, unsafe tool use, identity and delegation failures, excessive agency, data exposure, tenant isolation, and sandbox escapes.
- Threat model new capabilities. Identify trust boundaries, abuse cases, and high-impact failure modes before implementation. Translate findings into practical, prioritized mitigations.
- Perform hands-on testing. Investigate suspected vulnerabilities, develop proofs of concept, assess exploitability and impact, and partner with engineers through remediation.
- Build scalable guardrails. Develop secure defaults, approved patterns, reusable controls, review requirements, and automated checks that reduce recurring risks.
- Strengthen engineering capability. Pair with engineers, document practical guidance, and help product teams develop durable security expertise.
- Influence risk decisions. Explain technical findings, business impact, and remediation options clearly to engineers, product leaders, and executives.
YOU MAY BE A GOOD FIT IF
- You have strong software engineering fundamentals and can independently understand, test, and contribute fixes to production codebases.
- You are proficient in at least one of Python, Go, or TypeScript.
- You have led security reviews or threat models for complex production systems and can point to meaningful design or risk improvements that resulted.
- You understand common vulnerability classes and their underlying design failures, including injection, authorization flaws, IDOR, SSRF, unsafe deserialization, race conditions, cryptographic misuse, and software supply-chain risks.
- You understand modern application architecture, including web applications, APIs, OAuth/OIDC, cloud platforms, containers, Kubernetes, and CI/CD systems.
- You can reason rigorously about untrusted input, authorization, isolation, identity, delegation, and data boundaries. Direct experience with agentic AI systems is valuable but not required.
- You have driven security improvements involving multiple engineering teams, including situations where influence mattered more than authority.
- You communicate clearly with both technical and non-technical audiences.
NICE TO HAVE
- Experience building or operating security tooling such as SAST, DAST, SCA, custom linters, or policy-as-code.
- Experience securing multi-tenant SaaS, enterprise software, or systems that process sensitive customer data.
- Offensive security experience through penetration testing, red teaming or security research.
- Experience operating or participating in a vulnerability disclosure or bug bounty program.
- Contributions to open-source security projects, published research, conference talks, or credited vulnerability discoveries.
FULL-TIME EMPLOYEES AT COHERE ENJOY THESE PERKS:
- A weekly lunch stipend of $75/£75 or equivalent in your local currency for lunch.
- Full health and dental benefits, including a separate budget for mental health.
- RRSP matching, 401K, Pension Scheme.
- 100% Parental Leave top-up for up to 6 months, for either parent.
- Annual enrichment benefits:
Arts & culture, fitness/wellness, quality time, and a workspace improvement credit.
Education & learning stipend for conferences, courses, and coaching.
- 6 weeks of paid vacation (30 working days!)
- Budget for traveling to other offices if you are remote, plus an annual company offsite.
HOW AND WHERE WE WORK:
- Cohere is remote-friendly, but we also have offices in Toronto, London, New York City, San Francisco, Montreal, Paris, Berlin and Seoul with more opening soon.
- For those in the office: a daily lunch program, plenty of snacks, and regular community and social events.
- For those not near an office: a co-working benefit so you can work alongside others in your city.
- Everyone receives a $500 home office stipend to set up your workspace properly.
If any of the above doesn’t line up exactly with your experience, we still encourage you to apply.
We strive to create an inclusive work environment for all; we welcome applicants from all backgrounds and are committed to providing equal opportunities. Should you require any accommodations during the recruitment process, please submit an Accommodations Request Form https://docs.google.com/forms/d/12a6IrLdF3kI2nonKSr4tiFuz18rLQbaeYV-JM9L4o9Q/edit, and we will work together to meet your needs.
We may use AI-enabled tools to screen and assess applicants against the criteria for this position. This helps our recruiters identify potentially qualified candidates, but it doesn't limit the applications our recruiters may review or consider.
Beware of Scams: Cohere will never ask for payment or third-party services (e.g., CV writing) as part of our hiring process. All legitimate roles are listed on the Cohere careers page and LinkedIn only, with all communications from Cohere employees coming from an @cohere.com or @cw.cohere email alias. If jobs are viewed on other sites then please verify these through our official careers https://cohere.com/careers page.