# Software Engineer, Product Security at Arena

- Company: Arena
- What the company does: Chat, compare, vote for the world's best AI models. Join the community shaping the public leaderboard for LLMs, image, and code models through real-world evaluation. Backed by Lightspeed and a16z.
- Company website: https://arena.ai/
- Type: Startups (AI role)
- Level: Mid level
- Location: Bay Area
- Work setup: On-site
- Pay: $150K to $350K base salary per year (USD)
- Posted: 2025-12-18
- Apply by: 2026-10-08
- Apply: https://jobs.ashbyhq.com/arena/d1c71ccd-8fbf-42cb-82b5-06694e1b79f3
- Page: https://www.1752.vc/careers/jobs/arena-software-engineer-product-security/

## About the role

This is an engineering role. The work is in the product code: the authorization and identity layer, the API surfaces our users and partners depend on, and the libraries and patterns other engineers build on top of. You will design systems, write production code, and ship on the same cadence as the rest of engineering.

## What they're looking for

- We care most about two things: recent hands-on production engineering, and code-level application security judgment
- Application and API security: you apply it at the code level, not the checklist level. Authorization models, session and token handling, and multi-tenant isolation, with a specific problem you found or fixed that you can explain down to the mechanism
- 6+ years of software or security engineering experience, with meaningful time building and shipping production systems at scale
- Strong proficiency in a modern backend language, and the judgment to design interfaces other engineers will live with for years
- Solid data fundamentals. You're comfortable modeling and querying Postgres, you know where security decisions belong in a data layer, and you have run migrations against production data without breaking it
- Working fluency with cryptographic application primitives: HMACs, secure random generation, key and secret rotation, and the ways sensitive data leaks through logs, traces, and stored payloads

Tags: Security