Principal Product Security Engineer

This is a fully remote position, open to applicants in Arizona, +11 more locations.

📋 Description

• Ensure that every Entrata product achieves a high standard of security assurance.

• Lead security efforts throughout the software development lifecycle, from product design to release and ongoing operations.

• Advance the Product Security program in response to emerging threats, new technologies, and industry best practices.

• Collaborate with Engineering, Product, Architecture, Cloud Infrastructure, Compliance, and Security teams to identify and mitigate risks.

• Implement scalable security automation solutions.

• Address complex security incidents and novel attack vectors.

• Conduct security reviews, design assessments, and threat modeling throughout the SDLC.

• Establish product security standards, baseline requirements, and secure design patterns.

• Identify and remediate systemic product security risks in partnership with engineering teams.

• Lead incident response efforts, vulnerability investigations, and post-incident remediation processes.

• Develop automated security guardrails and CI/CD pipeline gates utilizing SAST, DAST, and secrets scanning tools.

• Champion security architecture for AI/LLM integrations and cloud-native services.

• Oversee supply chain security, dependency risks, SCA tooling, and SBOM governance.

• Establish and mentor an engineering Security Champions program.

• Manage external penetration testing, Bug Bounty programs, and vulnerability roadmaps.

⛳️ Requirements

• 8+ years of experience in Product/Application Security with hands-on coding proficiency in Python, Go, Java, or Node.js.

• Proven track record in threat modeling, secure SDLC, and risk-based vulnerability management.

• Extensive expertise in securing cloud-native SaaS environments, including AWS/GCP, Docker/Kubernetes, and APIs.

• Hands-on experience in responding to security incidents and emerging attack techniques.

• Demonstrated ability to lead cross-functional engineering and product security initiatives.

• Strong understanding of OWASP Top 10/LLM, NIST, SOC 2, and PCI-DSS standards.

• Excellent technical communication skills to convey risks to non-technical leadership.

• Demonstrable experience using AI-powered development tools such as Codex, Cursor, or Claude Code.

• Industry certifications such as CISSP, CSSLP, or OSCP, or equivalent practical cybersecurity experience are preferred.

• Experience in B2B SaaS organizations of similar size or larger is preferred.

• Practical experience utilizing GenAI tools for workflow automation and AI output auditing is preferred.

• Ability to leverage company-approved GenAI tools to streamline routine tasks and expedite high-value deliverables.

• Responsible for auditing AI outputs for factual accuracy, brand alignment, and the removal of hallucinations.

• Commitment to adhering to AI security protocols to prevent unauthorized exposure of proprietary or PII data.

• Capability to craft clear, context-rich prompts for consistent and high-quality results.

🏝️ Benefits

• Flexible and transparent work culture with remote and hybrid options.

• Generous vacation policy.

• Frequent company recharge days.

• Comprehensive medical, dental, and vision insurance, including fertility benefits, for eligible employees and their families.

• HSA/FSA options available.

• Employer-paid disability benefits for qualifying employees.

• 401(k) or similar retirement plans with employer matching for eligible employees.

• Wellness initiatives that promote physical and mental well-being.

• Access to an onsite gym at headquarters.

• Gym memberships available.

• Mental health resources provided.

• Wellness challenges to encourage participation.

• Employee assistance programs offered.

• Opportunities for volunteerism and charity through Entrata Cares.

• Exclusive Previ cell phone plan available.

• Discounts on services and local business partnerships.

• Bi-annual swag drops for employees.