Product Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee application security assessments and threat modeling, which includes secure code reviews, architectural design evaluations, and testing.

• Create automated testing processes and enhance the Secure Software Development Life Cycle (SDLC).

• Take ownership of application security vulnerability management.

• Organize and manage penetration testing activities.

• Formulate application security best practices tailored for software engineers and product teams.

• Establish and uphold the bug bounty program.

• Initiate platform security projects that safeguard TRM data.

• Cultivate security champions within engineering teams.

• Coordinate secure coding training sessions and promote a security-centric culture among engineering staff.

• Conduct rapid threat evaluations and prioritize vulnerabilities based on business impact.

• Embed security testing and reviews into the Product Shipping Framework and CI/CD pipelines.

• Offer timely security training, real-time guidance, and code review support.

• Enhance lightweight security tools for optimal development and deployment efficiency.

• Collaborate extensively with engineering teams and their leadership.

⛳️ Requirements

• At least 8 years of experience in software development and testing.

• A Bachelor’s degree (or equivalent) in Computer Science, Computer Engineering, or a related discipline.

• Proficient in Python, NodeJS, and React.

• Strong grasp of encryption, authentication, and authorization protocols.

• Extensive experience with OWASP, CWE, testing methodologies, and security testing tools.

• Familiarity with security solutions for cloud platforms such as GCP and AWS.

• Knowledge of secure software development lifecycles, threat modeling, and security best practices.

• Proven experience in performing comprehensive code security reviews.

• Competence in triaging and addressing vulnerabilities in software packages or libraries.

• Experience with GitHub Advanced Security or other SAST, DAST, and SCA tools.

• Familiarity with web application testing frameworks like Burp Suite and OWASP ZAP.

• Experience with threat modeling tools such as OWASP Threat Dragon.

• Background in agile-based software development roles.

• Experience in red teaming or penetration testing of applications and infrastructure.

• Excellent written and verbal communication skills.

• Security certifications such as OSCP, CEH, and GWAPT are advantageous.

• Knowledge of security frameworks like NIST SP 800-171 and SSDF is a plus.

• Ability to operate in a distributed environment across EST, PST, and CEST time zones.

🏝️ Benefits

• Competitive benefits package, wellness programs, and time off policies, which vary by country and local employment regulations.

• A distributed-first remote work culture.

• Reasonable accommodations provided for applicants with disabilities.

• Opportunities for professional growth and development through impactful, mission-driven work.