<div class="content-intro"><p style="margin: 0in;"><strong><span style="font-family: 'Arial',sans-serif; color: black;">Company overview:</span></strong></p> <p>TraceLink is the world’s largest Agentic Business Network, enabling life sciences and healthcare companies to build and manage a scalable digital workforce of governed, no-code AI agents that execute and coordinate mission-critical supply chain operations alongside human teams. Powered by the Integrate-Once™ OPUS platform, TraceLink links more than 300,000 network participants, enabling multi-enterprise processes at global scale.</p> <p>Founded in 2009 with the simple mission of protecting patients, today Tracelink has 5 global offices, over 800 employees and more than 1700 customers in over 60 countries around the world. Our expanding product suite continues to protect patients and now also enhances multi-enterprise collaboration through innovative new applications such as MINT.</p> <p>Tracelink is recognized as an industry leader by Gartner and IDC, and for having a great company culture by Comparably.</p></div><p><span style="color:#000000">As part of the Product Security team, you will help secure and advance TraceLink's products and internal application development. Working closely with Product Managers, Architects, Software Engineers, and Security and continually improve how security is built into the software development lifecycle, including AI aspects.</span></p><br><p><span style="color:#000000">This is a senior individual contributor role. You will take on our hardest and least-defined product security problems, act as the security technical lead on major products and initiatives, and work with a high degree of autonomy. You are trusted to scope your own work, decide how a problem should be approached, and deliver with minimum supervision. You will remain deeply hands-on running assessments, reading and writing code, building the tooling and patterns that other engineers reuse.</span></p><br><p><span style="color:#000000">It increasingly also means securing AI-enabled product capabilities and the agentic tooling inside our own development pipeline, an area where the right answers are still being written and where we expect you to help work them out.</span></p><br><h2><span style="color:#548dd4"><b>What you will do:</b></span></h2><br><p><span style="color:#000000"><b>Partner with Engineering across the SDLC</b></span></p><br><ul><li><span style="color:#000000">Serve as senior security SME for engineering by supporting secure architecture, security requirements, and design reviews</span></li><li><span style="color:#000000">Lead threat modeling including abuse and misuse cases for AI-enabled and agentic features</span></li><li style="color:#000000 !important"><span style="color:#000000">Secure coding guidance for Java and JavaScript, manual and automated code review, including review of AI-assisted and agent-generated code</span></li><li style="color:#000000 !important"><span style="color:#000000">Triage and validate findings from SAST, SCA, DAST and secrets scanning, separating signal from noise and driving fixes to closure and tuning or retiring rules that produce more noise than value</span></li><li style="color:#000000 !important"><span style="color:#000000">Hands-on security assessments and white-box testing of services, APIs, and multi-tenant boundaries</span></li><li style="color:#000000 !important"><span style="color:#000000">Author the secure design patterns, guidance, and reusable components that engineering teams build against by default</span></li></ul><br><p><span style="color:#000000"><b>Build the paved road</b></span></p><br><ul><li><span style="color:#000000">Build and improve automation and guardrails in our CI/CD pipelines including pre-merge checks, policy-as-code, and golden paths that make secure the default rather than a gate</span></li><li><span style="color:#000000">Use AI and LLM tooling to scale security work by finding triage, code review, test generation, remediation guidance — with human verification of the output</span></li><li><span style="color:#000000">Maintain and tune the existing security toolchain, evaluate and pilot new tooling, bringing a clear technical recommendation when it is time to adopt or drop something</span></li><li><span style="color:#000000">Drive innovation and maturity in the SDLC with new toolsets and automation</span></li><li><span style="color:#000000">Track coverage, false-positive rate, time to remediate, and act on what they show</span></li></ul><br><p><span style="color:#000000"><b>Secure our AI features and AI supply chain</b></span></p><br><ul><li><span style="color:#000000">Review LLM and agent-backed features for prompt injection, excessive agency and data leakage</span></li><li><span style="color:#000000">Maintain clear security guidelines and controls for agentic code contributions, ensuring code review standards, proper attribution, and appropriate access safeguards</span></li><li><span style="color:#000000">Implement safeguards that detect and block unapproved or malicious changes introduced by AI agents</span></li><li><span style="color:#000000">Apply references such as the OWASP Top 10 for LLM Applications and MITRE ATLAS as practical