Product Security Engineer

Orbital is the AI platform for real estate legal work. Real estate shapes the world around us: our homes, our workplaces and our cultural landmarks. It’s the infrastructure that powers everyday life and is the world's largest asset class. Yet behind every single deal, real estate and legal teams work hard to navigate decades-old complexity; manually connecting documents, hidden obligations, geo-spatial context, and multiple parties into a path forward. We connect the legal and physical record, so that path is clearer than ever before. Our mission is to make real estate transactions faster, clearer, and less manual. Here, you'll be part of changing how the deals behind the largest asset class get transacted, and will help shape the future of real estate. A bit about us: 🚀 We’re building at the forefront of AI technology, without losing the deeply human expertise our clients depend on. 🏢 Orbital is built with former practising real estate lawyers and 250+ years of combined legal expertise. We're purpose-built for the complexity of real estate: accelerating due diligence, drafting and negotiation, and deal coordination with legal-grade precision. 💰 We've just raised a $60m Series B, led by Brighton Park Capital, to accelerate our global expansion – $75m raised to date. 🤝 We're trusted by 5,000+ real estate professionals, spanning UK Magic Circle and US Am Law 100 firms, to household names like M&S. Leading firms like BCLP, Orrick, Goodwin, Womble Bond Dickinson and Clifford Chance rely on Orbital to remove the busywork, freeing legal and real estate teams to focus on sharp judgment, standout client service, and closing deals faster. 💡 Working at Orbital means joining a bold, ambitious team, with the trust to take ownership and make a real impact from day one. Role Overview 🔎 We're looking for a Product Security Engineer to own the security of Orbital's product: the AI agent our customers use, the platform it runs on, and how we build both. Our customers are law firms and real estate businesses. They trust us with confidential transaction documents, and they ask hard questions about how we protect them. Our product is an AI agent that reads those documents, calls tools and runs code on a lawyer's behalf. That brings the usual cloud security work and a newer set of risks: prompt injection, agents acting on untrusted input, and attackers using AI to move faster than before. You'll be our first in-house product security engineer, taking on work we have so far relied on contractors for. You'll build security into the product rather than review it from outside: you'll decide how we rate a vulnerability and how fast we act on it, build the automated systems that find and fix issues before an attacker does, and set the security bar that engineering builds to. You'll work alongside our product engineers, with the authority to require changes across teams on security grounds, independent of any one team's delivery deadlines. An information security lead will own company-wide policy, compliance and customer assurance, and you'll work closely with them. You won't start from zero. Our AWS environment follows the Well-Architected Framework, with GuardDuty, Security Hub, encryption at rest and scoped credentials in place, and we hold SOC 2 and ISO 27001 commitments to our customers. What we need is someone to own it, find the gaps, and raise the standard as the company and the threat landscape grow. You'll get a chance to 👩‍💻 👨‍💻 Build an automated security harness. Put agents to work on our product: continuous red-team and blue-team loops that probe the agent, the platform and our code, find vulnerabilities, and propose or ship the fix. Manual review should be justified when required and automatic harness improvement is expected. Own vulnerability management end to end. Define how we classify severity and the response time each level demands, so a critical CVE gets fixed the same day. Automate patching, dependency and image scanning, and make sure findings reach an owner and get closed. Secure an AI agent in production. Threat-model how our agent handles untrusted documents, emails and web content, and the tools and sandboxes it uses. Design defences against prompt injection and data exfiltration, and test them. Make security part of how we build. Review designs and changes that touch authentication, tenant isolation, secrets and data handling. Turn recurring findings into automated checks so the protection holds without depending on someone remembering. Respond to security incidents. Lead the technical response when something goes wrong: containment, investigation and the fix. Build the technical side of our breach playbooks with our information security lead, and run the review afterwards. Choose and run our security tooling. Evaluate and roll out a cloud security platform (such as Wiz) and the detection, alerting and logging we need across AWS and Azure. As our only product security specialist, use tooling and AI agents to cover more ground than one person could alone. Test our defences. Run red-team exercises, manage external penetration testers, and run breach drills with engineering so everyone knows their part before it matters. Close the loop on findings. Fix what penetration tests and security researchers report to us, run responsible disclosure, and keep the technical evidence for our SOC 2 and ISO 27001 controls current, working with our information security lead. Make the work visible. Show leadership and engineering what the harness finds, what has been fixed and what risk remains, in plain language, with a recommendation for each open risk. You should apply if you ✍️ You build with agents. You'd rather put an agent loop on a problem than repeat a manual review. You've used AI agents to find, triage or fix security issues, and you aim for automation that leaves people to review only the exceptions. You have deep, hands-on security engineering experience. You've owned security for a