Security Engineer

Benefits

Parental leave

Not verified

Non-birth-parent leave

Not verified

Family-building benefits

• Fertility benefits: Not verified
• Adoption assistance: Not verified
• Surrogacy assistance: Not verified

Mental health support

Not verified

Relocation assistance

Not verified

Childcare support

Not verified

Learning budget

Not verified

Verification

Not verified

Salary

Not verified

401(k) match

Not verified

Was this benefit information wrong? Tell us.

Role

Role function

Security From the posting source checked Jun 20, 2026

Seniority

Mid From the posting source checked Jun 20, 2026

Work mode

Onsite From the posting source checked Jun 20, 2026

In-office days

5 days From the posting source checked Jun 20, 2026

Schedule

Shift type

Not verified

Weekend work

Not verified

Application

Cover letter

Not verified

Assessment

Not verified

Deadline

Not stated

Where they hire

State eligibility is not yet verified.

About this role

Security Engineer San Francisco | OnSite Who We Are Cognition is an applied AI lab building end-to-end software agents. We are behind Devin, the first AI software engineer, and Windsurf, an AI-native IDE. Our vision is AI that works alongside engineers as a genuine teammate, not a tool. We are a small, talent-dense team of competitive programmers, former founders, and researchers from Scale AI, Palantir, Cursor, Google DeepMind, and others. Role Mission Security Engineers at Cognition own one of the most interesting security surfaces in the industry. Devin executes arbitrary code on behalf of users across millions of sandboxed sessions. Windsurf operates inside developer environments at scale. Both products handle highly sensitive customer code, credentials, and infrastructure access. You will help define what security looks like for AI-native developer tools and build the controls, systems, and culture that let Cognition ship fast without compromising on safety. This is a role for engineers who want to do hands-on, high-leverage security work at the edge of what is being figured out for the first time. What You'll Accomplish - Secure the agent execution surface: Design and harden the sandboxing, isolation, and runtime controls that let Devin safely execute untrusted code and use tools across long-horizon tasks. - Own product and infrastructure security: Lead threat modeling, secure design reviews, and vulnerability management across Devin, Windsurf, and the underlying infrastructure they run on. - Build security tooling that engineers actually use: Create internal systems for secrets management, identity and access, dependency security, and detection

Read the full description at jobs.ashbyhq.com. FewerJobs shows a preview and links to the original posting.