Product Security Engineer

Orbital is the AI platform for real estate legal work. Real estate shapes the world around us: our homes, our workplaces and our cultural landmarks. It’s the infrastructure that powers everyday life and is the world's largest asset class. Yet behind every single deal, real estate and legal teams work hard to navigate decades-old complexity; manually connecting documents, hidden obligations, geo-spatial context, and multiple parties into a path forward. We connect the legal and physical record, so that path is clearer than ever before. Our mission is to make real estate transactions faster, clearer, and less manual.

We're looking for a Product Security Engineer to own the security of Orbital's product: the AI agent our customers use, the platform it runs on, and how we build both. Our customers are law firms and real estate businesses. They trust us with confidential transaction documents, and they ask hard questions about how we protect them. Our product is an AI agent that reads those documents, calls tools and runs code on a lawyer's behalf. That brings the usual cloud security work and a newer set of risks: prompt injection, agents acting on untrusted input, and attackers using AI to move faster than before.

You'll be our first in-house product security engineer, taking on work we have so far relied on contractors for. You'll build security into the product rather than review it from outside: you'll decide how we rate a vulnerability and how fast we act on it, build the automated systems that find and fix issues before an attacker does, and set the security bar that engineering builds to. You'll work alongside our product engineers, with the authority to require changes across teams on security grounds, independent of any one team's delivery deadlines.

An information security lead will own company-wide policy, compliance and customer assurance, and you'll work closely with them. You won't start from zero. Our AWS environment follows the Well-Architected Framework, with GuardDuty, Security Hub, encryption at rest and scoped credentials in place, and we hold SOC 2 and ISO 27001 commitments to our customers. What we need is someone to own it, find the gaps, and raise the standard as the company and the threat landscape grow.

You'll get a chance to:

• Build an automated security harness.
• Own vulnerability management end to end.
• Secure an AI agent in production.
• Make security part of how we build.
• Respond to security incidents.
• Choose and run our security tooling.
• Test our defences.
• Close the loop on findings.
• Make the work visible.

You should apply if you:

• Build with agents.
• Have deep, hands-on security engineering experience.
• Know AWS security well.
• Have led incident response.
• Take application and AI security seriously.
• Understand the product and the business.
• Help teams ship safely.
• Work independently.
• Bring people with you.

It would also be nice if you have:

• Experience securing LLM or agentic AI applications.
• Hands-on experience with SOC 2 and ISO 27001 audits.
• Experience with Azure, Kubernetes or container security.
• Familiarity with identity and SSO providers such as WorkOS or Okta.
• Experience in legal, financial or other regulated industries.

Security is everyone’s responsibility at Orbital. We ask all team members to follow our security policies, complete regular awareness training, and handle sensitive data with care in line with ISO 27001 standards. Spot something unusual? Reporting risks or incidents quickly helps us maintain the strong culture of security and compliance we all depend on.

At Orbital, we’re committed to building a diverse and inclusive team. We especially welcome applications from people who are traditionally underrepresented in tech. Even if you don’t meet every single requirement, or if the right role isn’t listed yet, we’d still love to hear from you.