Product Security Engineer, Operating System

About Haleos

We're building the operating system for how companies are founded and scaled. Haleos develops JaneOS1 and AtlasOS1 — AI that carries context across the whole journey, not a single chat. We're solving fundamental challenges in the entrepreneurial and organizational stack with production AI systems.

The Role

Secure the application layer and user-facing components of our platform. Design security controls for web, desktop, and mobile applications, protecting sensitive data at every touchpoint while keeping the experience seamless.

You Will

• Design and implement security controls for web, desktop, and mobile applications
• Build secure authentication and session management systems across multiple platforms
• Architect client-side security controls for browser-based applications handling sensitive business data
• Implement security measures for AI-powered features with real-time user interactions
• Design secure data handling for voice, text, and multi-modal AI interactions
• Build security controls for client-side data caching and offline functionality
• Conduct security assessments and penetration testing of application-layer components
• Implement content security policies, XSS prevention, and CSRF protection mechanisms
• Design secure communication protocols between client applications and backend services
• Build security monitoring for client-side threats and anomalous user behavior patterns
• Establish secure development guidelines for front-end and application developers
• Review and audit third-party dependencies and JavaScript libraries for vulnerabilities
• Implement secure file upload, download, and document handling systems

Must Have

• 4+ years of experience in application security, product security, or software security engineering
• Strong understanding of web application security (OWASP Top 10, CSP, SOP, CORS)
• Experience securing modern web frameworks (React, Next.js, Vue, or similar)
• Proficiency with browser security models and client-side security controls
• Experience with secure authentication flows, token management, and session security
• Knowledge of API security from the client perspective, including secure API consumption
• Understanding of mobile and desktop application security principles
• Experience with security testing tools (Burp Suite, OWASP ZAP, or similar)
• Ability to perform code reviews with security focus
• Strong knowledge of cryptography and secure data handling in client applications

Nice to Have

• Experience securing AI/ML-powered applications or chatbot interfaces
• Background in security for real-time communication systems (WebRTC, WebSockets)
• Knowledge of Electron or similar desktop application framework security
• Experience with mobile application security (iOS/Android)
• Understanding of browser extension security
• Familiarity with secure multi-modal interaction systems (voice, text, video)
• Experience with progressive web app (PWA) security
• Knowledge of accessibility security considerations
• Background in security for productivity applications or collaboration tools
• Experience with secure offline-first application architectures
• Understanding of supply chain security for npm/JavaScript dependencies
• Certifications such as OSWE, GWAPT, or similar application security credentials

Benefits & Compensation

• Competitive salary and equity package
• Health, dental, and vision insurance
• 401(k) with company match
• Flexible PTO policy
• Remote-friendly work environment
• Professional development budget
• Opportunity to establish application security standards at an early-stage company