Product Security Engineer

About Collective: Collective is on a mission to redefine the way businesses-of-one work. Our technology and team of trusted advisors help members achieve financial independence by taking care of everything from business incorporation to accounting, bookkeeping, tax services, and access to a thriving community, all in one integrated platform. We believe in empowering self-employed people to enjoy the same tax savings that big companies get, so they can focus on their passion, not paperwork. Featured in Forbes, Business Insider, Yahoo, Bloomberg, Financial Times, TechCrunch, and more. We are backed by General Catalyst, Sound Ventures (Ashton Kutcher and Guy Oseary), QED Investors, Google’s Gradient Ventures, Expa, and other investors who have financed iconic companies like YouTube, Substack, Twitch, Box, Hims, Instacart, and Lyft. About the role: We're hiring a Product Security Engineer to build Collective's application security program — with AI agents at the center of it from day one. This is not a legacy appsec role where you triage a scanner queue by hand: you'll design and operate an agentic appsec pipeline where automated security testing across the stack — static analysis, dynamic testing, and dependency scanning — combines with AI-driven triage and automated security review of code changes to give engineering teams fast, high-signal feedback. Alongside the program, you'll drive vulnerability remediation across the platform — from finding to verified fix — and make targeted code changes that eliminate whole classes of vulnerabilities rather than patching them one at a time. You'll work closely with product engineers on a platform that handles our members' financial and tax data, where the cost of a missed vulnerability is real. What you'll do: - Build and operate an agentic application security program: the full testing stack — SAST, DAST, and software composition analysis (SCA) — integrated into CI/CD, LLM-based triage that separates real findings from noise,