> Markdown version of [/jobs/ext/1469201-mission-driven-product-security-engineer](https://www.wearedevelopers.com/jobs/ext/1469201-mission-driven-product-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # mission-driven Product Security Engineer - **Company:** Overland Ai - **Location:** Seattle, WA, United States - **Experience:** Starter - **Salary:** $170,000.0 - $200,000.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, C++ (Programming Language), Ubuntu (Operating System), Code Review, Cyber Security, Continuous Integration, Federal Information Processing Standards (FIPS), Firmware, Intrusion Detection and Prevention, Python (Programming Language), Key Management, Linux Kernel, Open Web Application Security, Robotic Automation Software, Software Engineering, Systems Integration, Data Logging, Software Security, Rate Limiting, Selinux, Cybercrime, Lidar, Static Application Security Testing, Dynamic Application Security Testing - **Published:** July 28, 2026 - **Apply:** https://www.dice.com/job-detail/06f04300-928f-4fbc-8c5f-47cd88d8fea6 ## About the Role * BS in CS/EE or related, or equivalent experience * 6+ years in cybersecurity or secure software development, with no less than 2 years in a product security or offensive security role * Direct experience with the Department of Defense (DoD) Risk Management Framework (RMF), NIST 800-53, CNSSI 1253, and documenting security controls for Authority to Operate (ATO) or Authority to Connect (ATC) packages in eMass * Proven ownership of SAST/SCA/DAST and CI/CD security controls * Strong Linux internals and hardening experience (Ubuntu and/or NixOS) * Hands-on with cryptography engineering, key management, and secure boot chains * Experience shipping signed firmware/OS images * Proficiency in either Python or C++, * Hands on experience with LabJack sensors, Dataspeed Drive By Wire Systems, Ouster Lidar, and CAN network systems * Familiarity with industry cybersecurity standards such as ISO 21434 or UN R155 * Certifications: GIAC GPEN/GXPN, OSCP, ISC2 CSSLP * Must be eligible to obtain and maintain a TS/SCI clearance ## Description Overland AI has secured funding from prominent defense tech investors including 8VC and Point 72, and built trusted partnerships with DARPA, the U.S. Army, Marine Corps, and Special Operations Command. Backed by eight-figure contracts across the Department of Defense, we are strengthening national security by iterating closely with end users engaged in tactical operations., We are looking for a mission-driven Product Security Engineer to embed security into the entire lifecycle of our cutting-edge robotic systems and our command and control system. You will be responsible for hardening our autonomous ground vehicles against cyber threats in complex, contested environments. You will own compliance with our customer's contract requirements for cyber security. In this role, you will take ownership of the security architecture for our robotic systems, ensuring that every component-from firmware to command interfaces-is designed, implemented, and validated with security at its core. You will architect and develop robust security controls to meet rigorous contractual and regulatory requirements, encompassing intrusion prevention, secure logging, encryption, and system integrity protections. You'll serve as the key integrator of feedback from customers, industry standards, and regulatory agencies, translating their input into clear, actionable security requirements for software development teams. As a compliance leader, you will map and implement controls aligned with CSEIG v3.0, DISA STIGs, and NIST 800-53/171, preparing the necessary documentation and evidence to support customer ATO and ATC efforts. You'll define and champion security across the software development lifecycle by implementing policies, security gates, and checklists for design, code review, CI/CD, and release. Each feature will include measurable security acceptance criteria to ensure continuous assurance., * Lead the design and validation of security controls that ensure system integrity, intrusion prevention, secure logging, and data protection for robotic platforms. * Collaborate with customers, regulators, and internal teams to define and document security requirements that guide software development and system integration. * Ensure compliance with CSEIG v3.0, DISA STIGs, and NIST 800-53/171 by implementing required controls and preparing evidence for certification and authorization (ATO/ATC) activities. * Drive a secure software development lifecycle (SDLC) by establishing policies, gates, and checklists across design, code review, CI/CD, and release processes. * Develop secure firmware and update mechanisms, including signed, atomic, and recoverable updates with built-in health checks, CVE management, and SBOM generation. * Harden operating systems (Ubuntu and NixOS) through CIS/STIG baselines, AppArmor/SELinux configuration, systemd hardening, and least-privilege enforcement. * Strengthen physical security through tamper-evident designs, interface protection, and side-channel attack mitigation. * Implement cryptographic controls including validated crypto modules, FIPS 140-3 compliance, TPM management, and secure/measured boot processes. * Build and maintain a secure software supply chain with artifact signing, provenance tracking, vendor risk reviews, and defined security SLAs. * Lead threat-modeling and Attack Tree exercises across robotic, autonomy, and C2 systems to identify vulnerabilities and define mitigations. * Establish robust API security aligned with OWASP ASVS, implementing mTLS, key management, rate limiting, and secure session controls. * Apply ROS 2 security principles, including DDS-Security and namespace policies, to ensure authenticated and confidential message exchange. * Define and support operational security requirements, covering log collection, forensics, and automated intrusion detection and prevention. * Safeguard command integrity via CAC/PIV-based client authentication, mutual TLS, and role-based authorization enforcing least-privilege access. ## Related Videos - [How to develop an autonomous car end-to-end: Robotic Drive and the mobility revolution](https://www.wearedevelopers.com/videos/22-how-to-develop-an-autonomous-car-end-to-end-robotic-drive-and-the-mobility-revolution) - [Enhancing Workload Security in Kubernetes](https://www.wearedevelopers.com/videos/356-enhancing-workload-security-in-kubernetes) - [Playing Pong on a shoulder press machine](https://www.wearedevelopers.com/videos/100140-playing-pong-on-a-shoulder-press-machine) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Remote Driving on Plant Grounds with State-of-the-Art Cloud Technologies](https://www.wearedevelopers.com/videos/251-remote-driving-on-plant-grounds-with-state-of-the-art-cloud-technologies) - [The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most](https://www.wearedevelopers.com/videos/100254-the-developer-workstation-blind-spot-why-your-security-stack-can-t-see-what-matters-most) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)