Product Security Engineer

This is a fully remote position, open to applicants in Slovakia.

📋 Description

• Serve as the primary security expert for a designated product area.

• Lead threat modeling, security evaluations, and vulnerability management throughout Bloomreach's platform.

• Assist in the implementation and adoption of Secure Software Development Lifecycle practices within engineering teams.

• Analyze application designs, system architectures, and infrastructure components to pinpoint security vulnerabilities and suggest mitigations.

• Engage in threat modeling for both new and existing products; identify threats, evaluate risks, and document recommendations.

• Offer security guidance to product and engineering teams utilizing established standards, patterns, and best practices.

• Execute security assessments, penetration testing, and validation testing across applications and environments.

• Triage, validate, assign, and facilitate the remediation of vulnerabilities.

• Collaborate with Engineering, DevOps, Compliance, and other cross-functional teams.

• Act as a security contact for routine security inquiries and tasks.

• Within the first 30 days, familiarize yourself with Bloomreach products, architecture, services, policies, tools, and security workflows; establish partnerships.

• Within the first 60 days, contribute to penetration tests and assessments, threat modeling, vulnerability triage, validation, and remediation recommendations.

• Within the first 90 days, independently conduct defined assessments, contribute to threat modeling, communicate findings, assist in remediation, provide ongoing security guidance, manage assigned tasks, and enhance processes, documentation, tooling, or workflows.

⛳️ Requirements

• A minimum of 2 years of practical experience in cybersecurity, application security, product security, or a related security field.

• Hands-on experience in performing or supporting security assessments and penetration testing for web applications.

• Familiarity with threat modeling concepts and methodologies, such as STRIDE.

• Understanding of the fundamentals of vulnerability management, including validation, risk-based prioritization, remediation tracking, and retesting.

• Exposure to AI and LLM technologies, with an interest in related security risks and controls.

• Working knowledge of modern application architectures, APIs, authentication and authorization methods, and common application security considerations.

• Knowledge of OWASP standards and resources, including OWASP Top 10, Testing Guide, and secure development practices.

• Hands-on experience with or familiarity with Burp Suite, OWASP ZAP, Nmap, SAST/SCA tools, and other application security technologies.

• Ability to analyze and validate security findings, prioritizing vulnerabilities based on technical risk and business context.

• Strong communication skills with the ability to document findings and convey technical concepts effectively.

• Self-motivated and proactive; eager to learn, take ownership, and contribute to process improvements.

• Capability to collaborate with Security, Engineering, DevOps, and other cross-functional teams.

• A continuous learning mindset and a keen interest in emerging technologies and threats.

• Excellent command of English, encompassing listening, speaking, reading, and written communication skills.

🏝️ Benefits

• A high degree of freedom and trust; no need for clocking in and out, corporate rules, or lengthy approval processes.

• Flexible working hours.

• Virtual-first work environment with Bloomreach Hubs located across three continents.

• Company-sponsored events.

• 5 paid days off for volunteering.

• People Development Program featuring personal development workshops.

• Access to communication coaching support.

• An annual professional education budget of $1,500 for books, courses, certifications, and more.

• Employee Assistance Program offering counseling services.

• Subscription to Calm.

• One additional DisConnect day off each quarter.

• Opportunities for sports, yoga, and meditation.

• Extended parental leave of up to 26 calendar weeks for Primary Caregivers.

• Restricted Stock Units or Stock Options based on role, seniority, and location.

• Company performance bonuses.

• Employee referral bonuses of up to $3,000.

• Rewards and celebrations for work anniversaries.