Platform Engineer, Product Security

ABOUT WISPR We're building the first voice interface a billion people use every day. Our first product, Flow, lets you talk instead of type anywhere on your computer or phone, and turns messy speech into polished text that is ready to send. It's scaled from $2M → $50M in ARR in under 12 months with millions of users and thousands of enterprise customers. How we think → https://wisprflow.ai/post/the-master-plan The team is still small enough that every person shapes what gets built. ABOUT THE ROLE People tell Flow things they'd never type into a search box. Their medical questions, their legal drafts, the fight with their husband. We're on the screen while they work, we hear the whole sentence, and millions of users and thousands of enterprises have entrusted us with their most confidential professional and personal messages. Wispr is built on a foundation of trust. Unlike most products, we carry a much deeper obligation to protect user data and build strong defenses against attacks and breaches. Why this is hard: agentic AI engineering brings speed, and it can open gaping security holes just as fast. Securing the product and user data against DDoS and breaches is a constant effort as we scale from millions of users to hundreds of millions, across mobile, web, desktop, wearables and whatever comes next. WHAT YOU'LL DO - Own product security end to end, prioritizing threats and architecting defenses. - Get into new surfaces early — design reviews where the design is still changing. - Build security into the platform so the safe path is the easy one. - Make the whole team better at this, without becoming the person everyone waits on. THIS ROLE IS PERFECT FOR YOU IF: - You enjoy decompiling code and finding vulnerabilities. - You have strong opinions about tradeoffs, and you're pragmatic about which battles matter. - You care as much about the user journey as the threat model. - You've naturally become the security person even though nobody asked you to. - This job description excites you. Tech stack: Python, FastAPI, WorkOS (SSO/SCIM), Supabase auth, AWS, Terraform, Gitleaks LOGISTICS Location. About 60% of the team is in San Francisco and the rest are remote, mostly US-based. - If you're in SF: you'll be in the office most days. We think the best work happens in person. Most of the team is here five days a week, and a few do three or four days depending on family or long commutes. - If you're remote: we're open to remote for some roles. We fly remote teammates to SF for three to four days a month. Visa sponsorship. We sponsor visas: H1B, O1, EB1, L1, STEM + OPT, and more. We can't successfully sponsor for every role and every candidate, but if we make you an offer we'll make every reasonable effort, and we retain an immigration law firm to help. WHAT WE OFFER We're a small, focused team that cares deeply about the quality of our work and the people we do it with. Here's what you can expect: - Equity on employee-friendly terms, including extended exercise windows and a combination of ISOs and RSUs. Ask us for more details! - Health, dental and vision. We cover 100% of the premium on the Anthem Blue Cross Gold PPO, and 75% of premiums for dependents. (US only) - 401(k) with up to a 4% match. (US only) - Flexible time off and company holidays. - All meals in the office, plus commuter benefits and relocation reimbursement if you’re moving to San Francisco. - A high-spec laptop, monitor, and a whisper-friendly microphone. - Regular team events and off-sites. - 16 weeks of paid parental leave (12 weeks for non-birthing parent). The early days with a new baby matter more than anything we're doing here, and we want you to be present for them. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and dou…