Principal Product Security Engineer

This is a fully remote position, open to applicants in Canada.

📋 Description

• Establish the security direction for key products and platforms.

• Spearhead multi-quarter, cross-functional security projects that significantly mitigate risk.

• Integrate security principles into roadmaps and everyday engineering practices.

• Define and refine security guidelines for AI-assisted development throughout design, coding, testing, review, deployment, and operations.

• Oversee cross-functional initiatives like secure SDLC enhancements and vulnerability reduction across various teams and quarters.

• Collaborate with engineering to develop automation for vulnerability detection, triage, and remediation, including STIGs/CIS baselines and policy-as-code.

• Enhance the operation and utilization of penetration tests, vulnerability assessments, bug bounty programs, and red-team activities.

• Direct the adoption and CI/CD integration of static/dynamic analysis, dependency and license checks, and IaC scanners.

• Assist in the maintenance and use of SOC 2, ISO 27001, NIST, and NIS2 frameworks to implement robust controls.

• Influence engineering and product leaders by presenting clear risk assessments and trade-off options.

• Mentor Product Security Engineers and elevate the security standards across the organization.

• Monitor emerging threats and supply chain risks, translating them into actionable changes in controls, tools, and product direction.

⛳️ Requirements

• Over 10 years of experience in software, product, or application security, with responsibility for complex products or platforms.

• Extensive knowledge in secure architecture and system design for cloud-native or distributed systems, including modern authorization/authentication and defense-in-depth strategies.

• Proven experience in driving organizational-level risk management and security initiatives, including secure SDLC, AI SDLC, and vulnerability management, from conception to implementation.

• Strong practical knowledge of cloud-native environments, including containers, Kubernetes, public cloud, and relevant security controls.

• Familiarity with security compliance frameworks such as SOC 2, ISO 27001, and SLSA, and the ability to translate controls into actionable engineering tasks.

• Proficiency in automating security workflows in at least one programming language, such as Go, Python, or Shell, and integrating them into CI/CD processes.

• Demonstrated capability to influence senior stakeholders and foster alignment across teams through clear and concise communication in a remote-first setting.

• High level of ownership, accountability, and adaptability with the ability to foresee risks, navigate uncertainty, and enhance systems and teams.

• Nice to have: Experience in software supply chain security, including SBOMs, SLSA, provenance, signing, and build system hardening.

• Nice to have: Background in red teaming or offensive security and/or involvement in open source software development within security-sensitive projects.

• Nice to have: Public speaking or writing on security subjects and active participation in industry communities or standards.

• Nice to have: Prior experience in early-stage or rapidly growing companies.

🏝️ Benefits

• Flexible & Remote-First Culture: Work remotely with opportunities for team meetups, bi-annual destination summits, and a monthly stipend for coworking spaces, phone, and internet expenses.

• Stock options granted upon hire and promotion.

• Eligibility for participation in secondary offerings.

• A 10-year period to exercise stock options.

• 100% coverage for health, vision, and dental insurance premiums for employees and their dependents.

• Unlimited Flexible Time Off.

• 18 weeks of paid parental leave for birthing parents and 12 weeks for non-birthing parents.

• Option to take parental leave all at once or spread it throughout the child's first year.