Senior Director, Product Security

What Success Looks Like

• Product teams involve Product Security early enough that material risks can be addressed in architecture and implementation, not discovered only before launch.
• Ro has a clear product-security strategy with explicit priorities, owners, investment decisions, and measures of progress.
• Security controls for AI-enabled products are grounded in realistic abuse cases, instrumented in production, and improved as Ro's use of agents and automation evolves.
• Identity and KYC decisions balance confidence, customer experience, fraud risk, and operational cost across web and mobile experiences.
• Developers can use repeatable security tooling and guidance in their normal delivery workflows, with adoption and impact visible to leadership.
• Senior engineers on the team have clear ownership, room to lead, and a path to grow their scope and influence.

What You'll Do

• Lead Ro's Product Security function across application security, mobile security, architecture review, AI product risk, and product-facing vulnerability management, while coordinating closely with cloud and data security partners.
• Establish the function's long-term priorities and operating model. Convert company risk choices into sequenced engineering initiatives, staffing and investment needs, accountable owners, and outcome-oriented metrics.
• Set expectations for secure product development, including architecture review, threat analysis, security testing, developer guidance, and patterns that teams can reuse without adding unnecessary friction.
• Own the security approach for AI-assisted customer service and internal automations. Address threats such as prompt injection, unsafe tool use, data exposure, and manipulation, and ensure that evaluation and production monitoring inform ongoing control improvements.
• Provide senior security leadership for identity verification and KYC. Partner with Product and Commerce on verification flows and the signals used to make risk decisions.
• Expand automated security checks for web, mobile, and AI development within CI/CD and engineering workflows. Track where controls are used, where they are bypassed, and whether they reduce meaningful defect classes.
• Use penetration testing, threat analysis, vulnerability data, and bug bounty findings to identify systemic issues and communicate changes in Ro's risk posture to executives.
• Develop security education and enablement that changes engineering behavior: better designs, earlier engagement, fewer repeated vulnerability patterns, and stronger ownership by product teams.
• Manage and grow a senior technical team. Define durable areas of ownership, coach emerging leaders, and evolve the organization as Ro's product and risk surface expands.

What You'll Bring to the Team

• 12+ years of relevant experience across security and engineering, including meaningful experience building or shipping production software and leading security work in fast-moving technology organizations.
• Leadership experience in product security for a consumer-facing business where account compromise, abuse, fraud, payments, or other adversarial behavior are recurring operating concerns. Experience in consumer health, fintech, marketplaces, or a comparable environment is especially relevant.
• Strong technical depth in application security, secure architecture and design, and vulnerability management, with the credibility to work directly with experienced software and security engineers.
• Experience securing both web applications and native mobile applications at a meaningful consumer scale.
• Practical knowledge of identity verification, KYC, and fraud risk, including the product and engineering trade-offs involved in high-confidence, low-friction verification.
• Working familiarity with modern software delivery and security tooling, including CI/CD systems and technologies such as GitHub and Snyk, plus enough fluency in languages used by Ro teams - including Java, Python, Swift, Kotlin, and JavaScript/Node.js - to engage constructively in technical decisions.
• Ability to explain technical and product risk in concrete business terms, make recommendations under uncertainty, deliver clear guidance and build alignment across teams with competing priorities.
• Demonstrated ability to develop senior engineers, delegate meaningful ownership, and create clarity in organizations that are changing quickly.
• Master's degree in computer science or engineering, or equivalent practical leadership experience.

We’ve Got You Covered

• Full medical, dental, and vision insurance + OneMedical membership
• Healthcare and Dependent Care FSA
• 401(k) with company match
• Flexible PTO
• Wellbeing + Learning & Growth stipends
• Paid parental leave + Fertility benefits
• Pet insurance
• Student loan refinancing
• Virtual resources for mindfulness, counseling, and fitness