Principal Product Security Engineer

This is a fully remote position, open to applicants in United States, +2 more countries.

📋 Description

• Establish the product security strategy across key products and platforms.

• Direct multi-quarter, cross-functional security initiatives that significantly mitigate risk.

• Integrate security by design into roadmaps and everyday engineering efforts.

• Create and refine security guardrails for AI-assisted development throughout design, coding, testing, reviewing, deploying, and operating phases.

• Manage cross-functional secure SDLC and vulnerability reduction programs that encompass multiple teams over several quarters.

• Develop automation for vulnerability detection, triage, and remediation, including STIGs/CIS baselines and policy-as-code.

• Enhance pentest, vulnerability assessment, bug bounty, and red-team initiatives.

• Oversee the integration of static/dynamic analysis, dependency and license checks, and IaC scanners into CI/CD pipelines.

• Assist in achieving SOC 2, ISO 27001, NIST, and NIS2 compliance through sustainable, automation-friendly controls.

• Counsel engineering and product leaders on risk assessment and trade-offs.

• Mentor Product Security Engineers.

• Monitor emerging threats and supply-chain risks and translate these into adjustments in controls, tooling, and product direction.

• Collaborate directly with engineering and product leadership with a high degree of autonomy.

⛳️ Requirements

• Over 10 years of experience in software, product, or application security, with responsibility for complex products or platforms.

• Profound knowledge in secure architecture and system design for cloud-native or distributed systems.

• Familiarity with contemporary authorization/authentication and defense-in-depth strategies.

• Proven experience in leading organization-wide risk management and security programs, including secure SDLC, AI SDLC, and vulnerability management.

• Practical experience with containers, Kubernetes, public cloud, and relevant security controls.

• Knowledge of SOC 2, ISO 27001, and SLSA compliance frameworks.

• Capability to automate security workflows in Go, Python, Shell, or other programming languages and incorporate them into CI/CD processes.

• Proficiency in influencing senior stakeholders and fostering cross-team alignment through clear, concise communication in a remote-first environment.

• Strong sense of ownership, accountability, and adaptability.

• Experience in software supply chain security, including SBOMs, SLSA, provenance, signing, and build system hardening (preferred).

• Background in red-teaming or offensive security and/or contributions to open source software development in security-sensitive projects (preferred).

• Experience in public speaking or writing on security topics and active participation in industry communities or standards (preferred).

• Previous experience in early-stage or high-growth companies (preferred).

🏝️ Benefits

• Remote work with opportunities for team meetups.

• Bi-annual destination summits.

• Monthly stipend for coworking spaces, phone, and internet expenses.

• Stock options available upon hiring and promotion.

• Participation in secondary offerings.

• 10 years to exercise stock options.

• Health, vision, and dental insurance premiums fully covered for employees and their dependents.

• Flexible time-off policy.

• 18 weeks of paid parental leave for birthing parents.

• 12 weeks of paid parental leave for non-birthing parents.

• Equal opportunity employer.