Product Security Engineer

Rapsodo is a global sports technology company with offices in Singapore, the United States, Türkiye, Japan, and Malaysia. We develop data-driven sports analytics products that combine computer vision, AI, hardware, and cloud technologies to help athletes measure, understand, and improve their performance. Our products deliver accurate, real-time performance insights in demanding environments, supporting professional athletes, coaches, and sports organizations around the world. At Rapsodo, engineers take ownership from concept to production, working across multidisciplinary teams to build innovative products that transform complex motion into actionable insights at global scale. About the role Rapsodo builds sports technology used by athletes, coaches and teams worldwide, including golf and baseball launch monitors that combine computer vision, embedded hardware, mobile apps and cloud services. We are hiring a Product Security Engineer to own security validation and testing of our products end to end, with AI-driven tools and agents as the main engine of your testing.You will be the person who tries to break what we build before anyone else does. You will use AI to scale that work: generating and running test cases, fuzzing inputs, reviewing code and firmware, and triaging results. You will collaborate closely with our cloud, mobile app and device teams, turning findings into fixes and building the test practice that keeps every release secure. What You'll Do Threat Modeling: Build and maintain threat models across cloud, mobile, network, and device components, defining security priorities with engineering leads. Cloud and API Security Testing: Test backend services and APIs for authentication, authorization, token handling, account and subscription abuse, and cloud misconfigurations. Mobile Application Security Testing: Assess Android and iOS applications, including native and Kotlin Multiplatform apps, for vulnerabilities such as insecure storage, log leakage, reverse engineering, tampering, and certificate pinning bypass. Wireless and Network Security Testing: Assess Bluetooth Low Energy (BLE), Wi-Fi provisioning, and local network protocols, focusing on secure pairing, MITM resistance, and channel encryption. Device and Firmware Security Testing: Evaluate embedded Linux devices on ARM platforms, including secure boot, firmware integrity, key storage, debug interfaces, and service-level privilege separation. Licensing and Entitlement Testing: Identify ways to bypass feature and subscription enforcement through modified clients, replayed tokens, or altered firmware. Security Test Automation: Use AI agents and LLM-based tools to generate, execute, and analyze security tests, integrating automated checks such as SAST, dependency and SBOM scanning, fuzzing, and regression testing into CI pipelines. Vulnerability Reporting and Remediation: Document findings with severity levels and reproduction steps, collaborate with cloud, mobile, and device teams on fixes, and verify remediation. External Security Coordination: Coordinate third-party penetration tests and manage vulnerability reports submitted by external researchers. Security Strategy and Continuous Improvement: Contribute to product security standards, testing strategies, and the continuous improvement of security practices across Rapsodo's products. What We're Looking For Hands-on experience or solid knowledge of security testing through professional experience, internships, university projects, CTFs, or personal labs. Strong curiosity about security vulnerabilities across cloud APIs, mobile applications, wireless communication (BLE, Wi-Fi), and embedded Linux devices. Experience with or a strong interest in using AI tools and LLM agents to generate, execute, and analyze security tests. Good understanding of security fundamentals, including TLS, certificates, authentication, authorization, encryption, and signed tokens. Familiarity with tools such as Burp Suite, Wireshark, Frida, or Ghidra; hands-on experience is a strong plus. Comfort working with Linux and ability to read and write code in Python; C/C++ knowledge is a plus. Awareness of OWASP Top 10 and similar application security guidelines. Clear written English and the ability to explain security findings so developers can reproduce and resolve them. Bachelor's degree in Computer Engineering, Computer Science, or a related field, or equivalent practical experience. Final-year students are also welcome to apply. Nice to Have Professional experience in product security, penetration testing, or security engineering, particularly with connected products or IoT. Hardware security testing experience, including UART/JTAG/SWD, flash dumping, glitching, or side-channel analysis. Familiarity with secure boot, TEE/TrustZone, secure elements, or TPMs on ARM platforms. Knowledge of IoT messaging and IPC protocols such as CoAP, MQTT, or ZeroMQ. Experience with fuzzing tools such as AFL++, libFuzzer, or protocol fuzzers. Cloud security experience with AWS or GCP, including IAM, secrets management, and Infrastructure as Code reviews. Relevant certifications such as OSCP, OSWE, GMOB, or GXPN. Published CVEs, security conference presentations, or a strong CTF track record.