Product Security Engineer, Agentic AI

We are Lenovo. We do what we say. We own what we do. We WOW our customers.

Lenovo is a US$83 billion revenue global technology powerhouse, ranked #153 in the Fortune Global 500, and serving millions of customers every day in 180 markets. Focused on a bold vision to deliver Smarter Technology for All, Lenovo has built on its success as the worlds largest PC company with a full-stack portfolio of AI-enabled, AI-ready, and AI-optimized devices (PCs, workstations, smartphones, tablets), infrastructure (server, storage, edge, high performance computing and software defined infrastructure), software, solutions, and services. Lenovos continued investment in world-changing innovation is building a more equitable, trustworthy, and smarter future for everyone, everywhere. Lenovo is listed on the Hong Kong stock exchange under Lenovo Group Limited (HKSE: 992) (ADR: LNVGY).

This transformation together with Lenovos world-changing innovation is building a more inclusive, trustworthy, and smarter future for everyone, everywhere. To find out more visit www.lenovo.com, and read about the latest news via our StoryHub.

In this role, you will

• Own security architecture and threat modeling for the agentic AI offering as a core part of the product roadmap, from early design through general availability and sustaining engineering.
• Build guardrails, sandboxing, and hardening directly into the product: agent tool-calling, prompt handling, and data access paths engineered in, not audited after the fact.
• Participate in design reviews and sprint planning alongside the engineers building agent orchestration, integrations, and platform features; security is planned and estimated like any other engineering work, not a separate gate.
• Write and maintain the products living threat model, using frameworks including OWASPs LLM Top 10, MITRE ATLAS, and the NIST AI Risk Management Framework, updated every release rather than once a year.
• Review teammates code and architecture for security issues, including tool-calling risk, prompt injection, excessive agency, and data exfiltration, as a standard part of the teams engineering process.
• Build the products governance and access control features, including agent identity, least-privilege permissions, and audit logging, as shippable capabilities of the product itself rather than side tooling.
• Own production security for the shipped product in managed services: monitoring, incident response, and vulnerability management for live deployments.
• Publish reference architectures and paved-road patterns that let pre-sales and delivery teams field the product safely, extending OAEs mission of arming field teams with field-ready IP.
• Contribute to product roadmap and prioritization decisions from a security and reliability lens, the same way any senior engineer on the team would.

• 7+ years of experience as a product or platform engineer with a security specialization, or as a security engineer who has shipped production features as part of a product engineering team, with strong coding proficiency (for example, Python or Go).
• We are looking for a CISSP certification with a specialization in Agentic AI. We care about what you have built and what you can do; self-taught practitioners and career changers are welcome.
• A genuine AI builder: you have shipped agents, tools, or automations with large language models as part of a real product and can walk through the hard parts.
• Experience building real backends and infrastructure, not just demos: APIs, data pipelines, authentication and secrets management, hosting and deployment (containers, Infrastructure-as-Code, CI/CD), and systems integration, made reliable with observability, evaluations, and graceful failure handling.
• Deep knowledge of the AI threat landscape, including frameworks such as OWASPs LLM Top 10, MITRE ATLAS, and the NIST AI Risk Management Framework, with practical experience addressing prompt injections, excessive agency, and related agentic AI risks.
• Experience securing or auditing agentic frameworks and tool-calling or MCP-style integrations operating in sandboxed environments.
• Proven ability to design scalable cloud infrastructure, API gateways, proxy architecture, and access controls for enterprise systems.
• Comfortable working within a product teams sprint cadence, design review process, and release cycle, contributing as a shipping engineer rather than an embedded auditor.
• Enough software and security foundation to build and secure production systems, with sound judgment on data handling and safe AI usage.

• Experience as a product or feature engineer who happens to specialize in security, rather than a security specialist who occasionally writes code.
• Experience with AI governance, data loss prevention, monitoring and logging, or guardrail tooling for AI usage at product scale.
• Experience building and hosting AI solutions in the cloud.
• A security background in application security, cloud security, or data protection.
• Experience with agentic frameworks such as LangChain, LlamaIndex, CrewAI, AutoGen, or Semantic Kernel.
• Track record building developer-first security tools and platform controls that preserve engineering velocity.
• Experience mentoring engineers or driving technical alignment across security, platform, and product teams.
• Experience enabling field or partner teams, such as pre-sales, delivery, or professional services, to safely adopt a shipped product.