[Buenos Aires] Product Security Engineer

Qu’s mission is to deliver world class enterprise software to help restaurant chains thrive in the face of increasing complexity, opportunities, and challenges.

Based in Rosslyn, VA, Qu is backed by leading Silicon Valley investors that have also backed Google, Uber, and Dropbox.

About The Role
Qu builds its software with an AI-first development lifecycle: AI coding agents produce most of the code, and engineers review it. This role owns whether that code is secure before it ships, and leads Qu's red team.

Red team at Qu is chaos engineering applied to security. The engineer states a hypothesis about a control, introduces the condition, and proves whether the control fired. Findings go to the detection and response engineer as the day's priorities; misses come back as the next hypotheses. The role also runs Qu's AI-assisted penetration testing tooling and sets the scope for the external penetration test.

What You’ll Do

• Leads the red team: maintains the hypothesis backlog, runs the tests, reports which controls fired, and hands misses to the blue team.
• Runs the AI-assisted penetration testing tooling: continuous, logged, and limited by a deterministic gate that controls what the agents may touch.
• Sets the scope for the external penetration test and retests every finding before closure.
• Holds the pull request gate: every AI-generated change goes through human review with security checks enforced in CI/CD.
• Runs the fix-feedback loop: every security fix is re-attacked and behavior-tested before release. A green test suite alone does not ship a fix.
• Owns the curated component inventory and version policy the AI coding agents build from, so generated code uses current, approved libraries.
• Triages vulnerabilities by reachability with the detection and response engineer: is the library present, is the method called, does user input reach it.
• Secures the AI agents and MCP servers in the development pipeline: inventory, authority boundaries, gateways, interrupts, provenance review.
• Owns the security automation harness the team's agents run on, documented from day one.
• Works directly with engineering squads and DevOps on findings, fixes, and change management.

Requirements

• Offensive security engineering: writes a hypothesis, runs it, documents whether the control fired. Reproduces findings as working exploits and turns them into regression tests.
• Software engineering: ships code into CI/CD (Azure DevOps or equivalent), reads pull requests line by line, builds pipeline checks.
• Cloud design: AWS, containers, serverless, IAM. Understands where a change can reach.
• AI-native operation: runs several AI agents at once with deterministic gates and logged actions; commands and audits rather than operating one task at a time.
• Judgment: states an agent's authority boundary and blast radius in writing before building it.
• Five or more years in security engineering, application security, or offensive security, with production code shipped.

This position may require occasional after-hours work and participation in an on-call rotation to support business needs.

Useful

• SBOM/SCA and reachability tooling, MCP protocol internals, Orca, Sumo Logic, PCI DSS and SOC 2, MITRE ATT&CK or AADAPT technique mapping.

Why Join Qu?

• Work with a team that values operational excellence, creativity, and customer obsession.
• Enjoy the freedom to innovate and solve problems using cutting-edge tools and approaches.
• Make a real impact by connecting security, compliance, and business operations seamlessly.