Principal Product Security Engineer

This is a fully remote position, open to applicants in California.

📋 Description

• Establish long-term product and cloud security strategies across various teams.

• Oversee Product Security Reviews for distributed, multi-tenant SaaS and customer-managed offerings.

• Conduct architecture and design evaluations, threat modeling, abuse-case analysis, targeted secure code reviews, and security test planning.

• Convert risks into engineering specifications, mitigations, tests, and secure defaults; ensure the intended risk reduction is achieved.

• Act as a principal authority on cloud security encompassing IAM, workload identity, network exposure, KMS, encryption, secrets management, logging, detection, containers, Kubernetes, serverless services, infrastructure as code, hardening, and data isolation.

• Direct the Product Security component of FedRAMP engineering, translating FedRAMP Moderate and NIST SP 800-53 control intentions into technical controls and evidence.

• Collaborate on authorization-boundary and significant-change decisions, continuous monitoring, vulnerability and change management, POA&M and deviation remediation, incident response, vendor evaluations, and assessor engagements.

• Investigate vulnerabilities and ambiguous signals from bug bounty programs, scanners, penetration tests, cloud detections, and internal reports.

• Assess exploitability, exposure, and impact; coordinate remediation efforts; validate fixes and workarounds; and search for variants and root causes.

• Advance risk-adaptive vulnerability management utilizing exposure, exploitability, CISA Known Exploited Vulnerabilities signals, asset criticality, customer impact, and regulatory timelines.

• Develop and manage security capabilities and developer-friendly pathways across CI/CD, SAST, SCA, secrets management, infrastructure as code, containers, cloud posture, and testing.

• Automate repetitive security tasks while maintaining human oversight for significant decisions.

• Define the scope and supervise external penetration tests, purple-team exercises, and security vendor engagements.

• Navigate multi-team collaborations through uncertainty and high-stakes scenarios, balancing security, reliability, delivery, customer impact, and compliance.

• Articulate complex risks, options, uncertainties, and recommendations to engineers, senior leaders, customers, assessors, and external stakeholders.

• Mentor Product Security engineers, security champions, and engineering colleagues.

• Establish standards, runbooks, automation, and continuity strategies.

• Assess and judiciously implement emerging technologies, including AI-assisted security engineering.

• Undertake stand-by, on-call, or off-hours responsibilities.

⛳️ Requirements

• Typically possess 10+ years of relevant experience in software security, security engineering, or software engineering, or demonstrate equivalent scope and impact.

• Significant hands-on experience in Application Security or Product Security, along with cloud security expertise.

• Experience in securing AI or agentic systems and applying AI responsibly within security engineering workflows.

• Proven track record at the principal level for setting technical direction across teams, leading multi-quarter initiatives, resolving ambiguous critical issues, and influencing senior Engineering and Product leaders without direct authority.

• Extensive hands-on experience with AWS and Azure security in production SaaS or cloud-native systems.

• Familiarity with identity and authorization, network controls, encryption and key management, secrets management, logging and detection, containers or Kubernetes, serverless services, infrastructure as code, and multi-tenant data isolation.

• Direct experience in implementing or managing product and cloud security controls within a FedRAMP-authorized or FedRAMP-bound setting.

• Understanding of NIST SP 800-53 control intentions, with experience in technical control implementation, evidence collection, continuous monitoring, vulnerability and change management, POA&M or deviation remediation, and assessor interactions.

• Expertise in leading security design reviews and threat modeling for complex applications, APIs, distributed systems, and cloud architectures.

• Strong knowledge of web and application vulnerabilities, exploit techniques, OWASP guidelines, authentication and authorization protocols, cryptography, common network protocols, and secure cloud operating practices.

• Ability to read production code and create maintainable automation using JavaScript or TypeScript, Python, Go, or similar programming languages.

• Hands-on experience in vulnerability response, encompassing exploitability analysis, root-cause and variant analysis, remediation design, validation of fixes and bypasses, stakeholder coordination, and incident support.

• Exceptional written and verbal communication skills.

• A bachelor’s degree in computer science, cybersecurity, or a related field—or equivalent practical experience.

• Availability for stand-by, on-call, or off-hours duties.

🏝️ Benefits

• Health insurance.

• Dental insurance.

• Vision insurance.

• Short-term disability insurance.

• Life insurance.

• Paid holidays.

• Paid time off.

• Fertility treatment benefit.

• 401(k).

• Equity.

• Cribl Corporate Bonus Program.