DataRobot
At a Glance
Job Description:
DataRobot delivers AI that maximizes impact and minimizes business risk. Our platform and applications integrate into core business processes so teams can develop, deliver, and govern AI at scale. DataRobot empowers practitioners to deliver predictive and generative AI, and enables leaders to secure their AI assets. Organizations worldwide rely on DataRobot for AI that makes sense for their business — today and in the future.
DataRobot is seeking an experienced Staff Product Security Engineer to drive security innovation while ensuring our platform meets the rigorous demands of our Federal and Commercial customers. This is a highly technical, high-impact role where you will operate at the intersection of engineering, automation, and federal compliance (FedRAMP High / DoD IL5).
You will serve as a subject matter expert for our Federal group, handle high-stakes customer security inquiries, and build automation using Python and Go. This role requires a unique blend of technical expertise, regulatory fluency, and diplomatic communication skills to navigate complex customer conversations.
Key Responsibilities:
Federal Compliance & Strategy
Lead Federal Security: Serve as a primary technical lead for the DataRobot Federal Group, driving the acquisition and maintenance of Authority to Operate (ATO) at FedRAMP High and DoD IL5 levels.
Compliance Engineering: Translate complex federal controls (NIST 800-53) into actionable engineering requirements for commercial developers.
Audit & Policy Management: Write and maintain security policies (SSPs) and procedures. Develop, track, and remediate Plans of Action and Milestones (POA&Ms) and provide technical evidence during third-party audits.
Security Engineering & Automation
Automate Everything: Develop custom automation to manage security tooling and implement "Secure-by-Design" processes in the CI/CD pipeline using Python or Go.
Container Security: Identify, design, and implement controls to safeguard our containerized production environments.
Tooling Management: Deploy and manage security testing tools for SAST, DAST, and SCA analysis (e.g., Semgrep, Trivy, Burp Suite).
Threat Modeling: Review technical designs for new features, performing threat models to prioritize risks and educate developer teams on secure coding practices.
Customer Trust & Vulnerability Management
Customer Engagement: Act as the external face of DataRobot Security. Work directly with customers' security teams to resolve concerns regarding CVE exposure and architecture.
Customer-Centric Communication: Balance business needs with security rigor. You must be able to stand firm on security policies while maintaining strong professional relationships through clear, diplomatic, and solutions-oriented communication.
Knowledge, Skills, and Abilities:
Federal Fluency: Deep understanding of the FedRAMP authorization process, NIST 800-53, and DoD Cloud Computing Security Requirements Guide (SRG).
Technical Proficiency:
Fluent in writing code using Python or Go to build security automation.
Must have a deep understanding of Linux containers (internals, security isolation).
Familiarity with Kubernetes orchestration is strongly preferred.
Hands-on experience with common security tools such as Semgrep, Trivy, and Burp Suite.
Strategic Mindset: Experience determining not just how to fix a bug, but why it happened and how to prevent it systemically.
Soft Skills: Strong leadership skills for guiding teams and liaising with various stakeholders.
Requisite Education and Experience:
8+ years of experience working in Information Security, with significant time spent in Product Security or AppSec roles.
Bachelor's or Master's degree in Computer Science, Cybersecurity, Information Systems, or a related field (or equivalent experience).
The talent and dedication of our employees are at the core of DataRobot’s journey to be an iconic company. We strive to attract and retain the best talent by providing competitive pay and benefits with our employees’ well-being at the core. Here’s what your benefits package may include depending on your location and local legal requirements: Medical, Dental & Vision Insurance, Flexible Time Off Program, Paid Holidays, Paid Parental Leave, Global Employee Assistance Program (EAP) and more!
DataRobot Operating Principles:
Research shows that many women only apply to jobs when they meet 100% of the qualifications while many men apply to jobs when they meet 60%. At DataRobot we encourage ALL candidates, especially women, people of color, LGBTQ+ identifying people, differently abled, and other people from marginalized groups to apply to our jobs, even if you do not check every box. We’d love to have a conversation with you and see if you might be a great fit.
DataRobot is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. DataRobot is committed to working with and providing reasonable accommodations to applicants with physical and mental disabilities. Please see the United States Department of Labor’s EEO poster and EEO poster supplement for additional information.
Use of Artificial Intelligence in Our Hiring Process
DataRobot uses approved AI-powered tools to support the hiring process in selected regions. These tools may assist in writing job descriptions, reviewing applications, assessing qualifications, and evaluating candidate materials. All decisions regarding applications are made by members of the DataRobot team.
All applicant data submitted is handled in accordance with our Applicant Privacy Policy.
Source: DataRobot careers · View original posting
DataRobot is an enterprise AI platform company based in Boston, Massachusetts, founded in 2012. The company focuses on making AI and machine learning accessible and impactful for businesses. Co-founded by Jeremy Achin and Tom DeGodoy, DataRobot addresses the shortage of skilled data scientists with its AutoML tool, which accelerates model building for users of varying expertise. The company offers a comprehensive AI platform that automates the entire machine learning lifecycle, from data preparation to deployment and monitoring. Key features include AutoML, an enterprise AI suite that supports generative and predictive AI, and user-friendly tools for collaboration and scaling AI. DataRobot serves over 1,000 organizations globally, including a third of Fortune 50 companies across various sectors such as healthcare, banking, and manufacturing. Its mission is to maximize business impact while minimizing risk, empowering teams with collaborative workflows and governance.
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
Security Philosophy
“DataRobot's stated AppSec mission is that their "multi-layered security program ensures compliance with industry standards". Their approach to working with developers is "focusing on business enablement". Their risk philosophy includes "automated compliance testing and one-click documentation". A stated goal is to "Implement a Human Feedback Loop". Information is not publicly available for an explicit, public "AppSec mission statement"authored by the AppSec team, or any public document describing a developer-facing "paved road"or explicit gatekeeping policy.”
Security Team
Regarding organizational structure, "a CISO has a seat at the executive-level during strategic or business discussions". The key public-facing leader is Andrew Smeaton, Chief Information Security Officer, who is "focusing on business enablement". Team size estimates and active AppSec job postings are not publicly available. Common skill/tool patterns observed include "Guard Library"for model/messaging protections, "automated compliance testing"and "observability"features, and API security where "All API communications are secured using TLS 1.3". There is no public org chart, no public list of AppSec leaders beyond the CISO, and no public headcount or active AppSec hiring list discovered.
Key Initiatives
There is no public evidence of a named Security Champions program. Regarding "Shift Left"practices, DataRobot "activates comprehensive observability, intervention, and moderation with just two lines of code"and "prompts are evaluated using configured guards in parallel". For vulnerability management intake, "We regularly perform penetration testing using a trusted third party"and conduct "annual external audits". Information on triage/remediation (SLAs, MTTR, ticketing ownership) is not publicly available. Secure SDLC artifacts include "security awareness training for employees"and "role-based access control". A recent initiative (last 6 months) is to "Deploy secure, compliant agentic AI on-prem and air-gapped". There are no public, AppSec-team-authored runbooks or public triage SLAs, and no public detailed vulnerability-to-ticket workflows identified.
Preparing for an AppSec interview?
Get the weekly briefing 2,000+ security pros trust.
Interested in this role?
Apply on DataRobot's site