Principal Security Engineer

Principal Security Engineer

We’re looking for a Principal Security Engineer to serve as the technical anchor for Procore’s Security Engineering organization . In this role, you will define the vision for autonomous security sovereignty. You are the strategic lead responsible for building a self-reasoning, self-healing security infrastructure that operates with zero-human intervention for entire classes of threats.

As a Principal Engineer , you will sit at the intersection of Security, AI, Data, and Engineering. You will lead the development of high-assurance, agentic security frameworks that protect our platform, data, and users. This is a high-impact leadership opportunity to shape the global security direction of a rapidly growing platform, leveraging the next generation of LLM-native engineering to protect the data of millions of users Apply today. This position reports into the Senior Manager, Security Engineering and will be based in the Bengaluru, India office .

What you’ll do

• At Procore, AI isn’t a specialized tool, it's a core competency. We expect every team member to be AI-literate, leveraging generative tools and agentic workflows to move faster and work smarter. You won’t just use AI; you’ll be building the agentic future of construction.

• Define the Agentic Strategy: Lead the long-term technical roadmap for moving Procore from traditional Security Engineering to an autonomous security fabric, where agents are the primary drivers of control enforcement and remediation.

• Architect Autonomous Identity Governance: Design and implement next-gen IAM guardrails where agents autonomously manage JML (Joiner-Mover-Leaver) processes, service-to-service authentication, and dynamic, least-privilege PAM.

• Build the Security Brain: Design and deploy the centralized agentic orchestration layer—utilizing LangGraph, Semantic Kernel, and CrewAI—to unify asset inventory, SBOM generation, and real-time attack surface management.

• Engineer Self-Healing Platforms: Partner with product engineering to build paved path infrastructure (Kubernetes, Terraform) that is managed by agents capable of autonomously detecting and correcting drift, misconfigurations, and vulnerabilities.

• Lead Autonomous Threat Modeling: Design agentic workflows that perform continuous, recursive threat modeling and automated "purple teaming" across our microservices architecture.

• Establish Agentic Trust Boundaries: Design the security controls for internal and customer-facing AI, specifically focusing on agentic sandboxing, output verification, and cross-agent authentication.

• M&A and Tech Stack Integration: Perform the technical security assessment of third-party platforms and M&A targets, using agentic tools to rapidly ingest, analyze, and secure diverse tech stacks.

• Force Multiplier & Mentor: Act as a technical catalyst, scaling agentic thinking across all of engineering and mentoring Staff and Senior engineers in building production-grade autonomous systems.

• Technical Advisor: Serve as the authoritative voice for the senior leadership on the security of our AI initiatives and the robustness of our autonomous defense posture.

What we’re looking for

• The Master Builder: 10+ years of experience in a high-level technical security role, with at least 4 years focused on large-scale SaaS. You must be an expert software engineer (Python, Go) who happens to specialize in security.

• Agentic Authority: Deep, verifiable experience building and shipping autonomous agent systems in production environments. You are an expert in LLM orchestration, tool-calling protocols, and multi-agent state management.

• Architectural Mastery: Expert-level knowledge of cloud security (AWS preferred) and container orchestration, specifically in designing the trusted execution environments required for agents to act with high privilege.

• Identity & Logic Expert: Mastery of identity protocols (OIDC, OAuth 2.0) and how they translate to agentic identity—ensuring that when an agent acts, its provenance and authority are cryptographically verifiable.

• AI Security Pioneer: Deep understanding of the LLM Attack Surface, from training data poisoning and prompt injection to RAG-based data leakage, with a track record of building production-grade mitigations.

• Strategic Visionary: Proven ability to align complex agentic initiatives with business growth and product velocity, ensuring security is a business enabler rather than a friction point.

• Data Protection Authority: Deep understanding of encryption-at-rest/in-transit and KMS, and how to apply these in an environment where agents must autonomously handle sensitive data.

• Systems Thinker: Ability to treat Prompt Engineering as a formal logic discipline, ensuring that autonomous reasoning is deterministic, testable, and safe.

• Exceptional Communicator: The ability to simplify the extreme complexity of Agentic Security for executive leadership while maintaining technical authority with the engineering front line.