Product Security Engineer

Orbital is the AI platform for real estate legal work. Real estate shapes the world around us: our homes, our workplaces and our cultural landmarks. It’s the infrastructure that powers everyday life and is the world's largest asset class. Yet behind every single deal, real estate and legal teams work hard to navigate decades-old complexity; manually connecting documents, hidden obligations, geo-spatial context, and multiple parties into a path forward. We connect the legal and physical record, so that path is clearer than ever before. Our mission is to make real estate transactions faster, clearer, and less manual. Here, you'll be part of changing how the deals behind the largest asset class get transacted, and will help shape the future of real estate. A bit about us: 🚀 We’re building at the forefront of AI technology, without losing the deeply human expertise our clients depend on. 🏢 Orbital is built with former practising real estate lawyers and 250+ years of combined legal expertise. We're purpose-built for the complexity of real estate: accelerating due diligence, drafting and negotiation, and deal coordination with legal-grade precision. 💰 We've just raised a $60m Series B, led by Brighton Park Capital, to accelerate our global expansion – $75m raised to date. 🤝 We're trusted by 5,000+ real estate professionals, spanning UK Magic Circle and US Am Law 100 firms, to household names like M&S. Leading firms like BCLP, Orrick, Goodwin, Womble Bond Dickinson and Clifford Chance rely on Orbital to remove the busywork, freeing legal and real estate teams to focus on sharp judgment, standout client service, and closing deals faster. 💡 Working at Orbital means joining a bold, ambitious team, with the trust to take ownership and make a real impact from day one. Role Overview 🔎 We're looking for a Product Security Engineer to own the security of Orbital's product: the AI agent our customers use, the platform it runs on, and how we build both. Our customers are law firms and real estate businesses. They trust us with confidential transaction documents, and they ask hard questions about how we protect them. Our product is an AI agent that reads those documents, calls tools and runs code on a lawyer's behalf. That brings the usual cloud security work and a newer set of risks: prompt injection, agents acting on untrusted input, and attackers using AI to move faster than before. You'll be our first in-house product security engineer, taking on work we have so far relied on contractors for. You'll build security into the product rather than review it from outside: you'll decide how we rate a vulnerability and how fast we act on it, build the automated systems that find and fix issues before an attacker does, and set the security bar that engineering builds to. You'll work alongside our product engineers, with the authority to require changes across teams on security grounds, independent of any one team's delivery deadlines. An information security lead will own company-wide policy, compliance and customer assurance, and you'll work closely with them. You won't start from zero. Our AWS environment follows the Well-Architected Framework, with GuardDuty, Security Hub, encryption at rest and scoped credentials in place, and we hold SOC 2 and ISO 27001 commitments to our customers. What we need is someone to own it, find the gaps, and raise the standard as the company and the threat landscape grow. You'll get a chance to 👩‍💻 👨‍💻 Build an automated security harness. Put agents to work on our product: continuous red-team and blue-team loops that probe the agent, the platform and our code, find vulnerabilities, and propose or ship the fix. Manual review should be justified when required and automatic harness improvement is expected. Own vulnerability management end to end. Define how we classify severity and the response time each level demands, so a critical CVE gets fixed the same day. Automate patch