Senior Product Security Researcher

Senior Product Security Researcher

Island is shaping the future of work - creating an enterprise workspace for both knowledge workers and agents - where access, security, and AI-powered productivity are built in. Our enterprise agentic control plane boosts productivity across devices, browsers, applications, networks, and data while protecting sensitive information, simplifying access, and helping enterprises scale AI safely.

Behind all of that is a team of people who care deeply about their craft and want to do the biggest and best work of their careers. At Island, character and drive matter more than your resume.

Backed by Coatue Management, Insight Partners, Sequoia Capital, Cyberstarts, and other world-class investors, Island is used by millions of people at some of the planet’s largest enterprises.

Come build with us. Together, we’re changing how the world works.

As a Senior Product Security Researcher at Island, you will attack our product the way a motivated adversary would. You will research how Island’s security controls, browser features, cloud services, and AI capabilities can be bypassed, abused, or turned against our customers, and you will work with R&D to fix the root causes. This role focuses on product logic, trust boundaries, and the application and cloud layers, rather than kernel or memory-level research.

Key Responsibilities

• Product Control Bypass Research: Find ways to bypass or weaken Island’s enforcement features, such as data loss prevention, clipboard, download and screenshot restrictions, data masking, and access policies, and help design controls that hold up under real attacks.

• Browser & Extension Security: Research the security of Island’s browser features, web platform integrations, and extension ecosystem, including the browser security model, extension permissions, and interactions between web content and privileged browser features.

• Backend, API & Identity Research: Assess Island’s management console, cloud services, and APIs for authorization flaws, tenant isolation issues, and weaknesses in authentication and identity flows (SSO, OAuth, SAML, OIDC).

• AI & Agent Security: Research the attack surface of Island’s AI and agentic features, including prompt injection, agent tool abuse, data exposure through AI workflows, and the security of MCP and agent integrations.

• Threat Modeling & Design Review: Work with developers, architects, and product managers to model threats for new features early in design, and turn research findings into concrete security requirements.

• Proof of Concept & Impact Analysis: Build proof of concepts that show real customer impact, and clearly explain risk and fix priority to engineering and leadership.

• Tooling & Automation: Build tools and AI-assisted workflows that scale research across a large and fast-moving codebase.

• Community & Knowledge Sharing: Mentor team members, contribute to internal playbooks, support our bug bounty program, and present research externally when appropriate.

Requirements

• Several years of hands-on experience in application security research, product security, or offensive security, with a strong track record of finding real vulnerabilities (CVEs, bug bounty, published research, or equivalent).

• Deep understanding of web and browser security: same-origin policy, CSP, cookies and sessions, extension security, and common web vulnerability classes (XSS, CSRF, SSRF, IDOR, auth bypass, logic flaws).

• Strong knowledge of authentication and authorization protocols (OAuth, OIDC, SAML) and multi-tenant SaaS security.

• Ability to read and review code in languages such as TypeScript/JavaScript, Go, Python, or C++.

• Strong adversarial thinking and the ability to find logic and design flaws, not only known bug patterns.

• Clear communication and the ability to work as a partner to engineering teams.

• Advantages

• Experience with Chromium architecture or enterprise browser and endpoint products.

• Experience researching LLM applications or agentic systems.

• Cloud security experience (AWS, Kubernetes).

• Experience building security tooling or using AI to speed up research.

• Data Privacy

• You can find information on how we process and protect your personal data in our Employee & Applicant Privacy Notice. For any privacy-related questions, contact our privacy team through the privacy notice.