Principal Product Security Engineer

This is a fully remote position, open to applicants in United Kingdom.

📋 Description

• Establish the security strategy for major products and platforms.

• Lead cross-functional security initiatives spanning multiple quarters to significantly lower risks.

• Integrate security by design into project roadmaps and daily engineering activities.

• Define and enhance security standards for AI-assisted development across design, coding, testing, review, deployment, and operations.

• Manage cross-functional programs such as secure SDLC enhancements and vulnerability mitigation.

• Collaborate with engineering teams to develop automation for vulnerability detection, triage, and remediation, including STIGs/CIS baselines and policy-as-code.

• Enhance the application of penetration testing, vulnerability assessments, bug bounty programs, and red-team activities so that findings result in meaningful engineering and process improvements.

• Facilitate the adoption and integration of static/dynamic analysis, dependency and license checks, and IaC scanners into CI/CD pipelines.

• Assist in maintaining and utilizing SOC 2, ISO 27001, NIST, and NIS2 frameworks to establish robust controls.

• Provide risk framing and trade-off options to engineering and product leaders.

• Mentor Product Security Engineers and elevate the security standards throughout the organization.

• Monitor emerging threats and supply-chain risks, translating them into necessary adjustments to controls, tooling, and product direction.

⛳️ Requirements

• Over 10 years of experience in software, product, or application security, with a focus on complex products or platforms.

• Profound knowledge of secure architecture and system design for cloud-native or distributed environments.

• Familiarity with modern authorization/authentication methods and defense-in-depth strategies.

• Proven experience in leading organization-wide risk management and security programs, including secure SDLC, AI SDLC, and vulnerability management, from inception to deployment.

• Strong hands-on experience with containers, Kubernetes, public cloud, and related security measures.

• Knowledge of security compliance standards such as SOC 2, ISO 27001, and SLSA.

• Capability to automate security workflows in at least one programming language, like Go, Python, or Shell, and incorporate them into CI/CD processes.

• Demonstrated ability to influence senior stakeholders and foster alignment across teams through clear and concise communication in a remote-first setting.

• High levels of ownership, accountability, and adaptability.

• Experience in software supply chain security, including SBOMs, SLSA, provenance, signing, and build system hardening is a plus.

• Background in red-teaming or offensive security and/or experience with open-source software development in security-critical projects is advantageous.

• Public speaking or writing on security topics and involvement in industry communities or standards is beneficial.

• Previous experience in early-stage or high-growth companies is an asset.

🏝️ Benefits

• Flexible & Remote-First Culture: Enjoy remote work with opportunities for team meetups, bi-annual destination summits, and a monthly stipend for coworking spaces, phone, and internet expenses.

• Receive stock options upon hire and with promotions.

• Participate in secondary offerings.

• 10 years to exercise stock options.

• Comprehensive health, vision, and dental insurance premiums fully covered for the employee and their dependents.

• Unlimited flexible time off.

• 18 weeks of paid parental leave for birthing parents and 12 weeks for non-birthing parents, which can be taken all at once or spread throughout the child's first year.

• Opportunities for team meetups.

• Bi-annual destination summits.

• Monthly stipend for coworking spaces, phone, and internet costs.