Product Security Engineer IV

This is a fully remote position, open to applicants in New York, +1 more state.

📋 Description

• Provide security support throughout the development lifecycle for designated College Board product teams.

• Engage in threat modeling, vulnerability assessments, and design reviews, including those involving AI-driven products and AI coding tools.

• Perform security code reviews and manage designated security tools.

• Assist in the remediation of identified vulnerabilities.

• Take part in product team planning, grooming, and design sessions.

• Contribute to the development of threat models and risk registers; document findings and escalate issues as necessary.

• Execute vulnerability assessments and utilize exploitability frameworks for risk prioritization.

• Implement security policies, audit requirements, and GRC standards to facilitate compliance activities.

• Review code and security design documentation, providing constructive feedback.

• Monitor and report on progress in relation to Product Security Framework requirements.

• Aid in security training, secure coding practices, and the Product Security Partners program.

• Document security insights and contribute to the communal knowledge base.

• Operate and oversee security tools across cloud environments and support CI/CD security controls.

• Track and report on security metrics.

• Participate in agile ceremonies and manage assigned stories and tasks.

• Act as the on-call first responder for owned security tools and assist in incident response.

⛳️ Requirements

• Over 4 years of experience in product security, application security, cloud security, or software engineering with security responsibilities.

• Extensive knowledge in application security, including the OWASP Top 10, secure coding practices, and security testing methodologies.

• Strong experience in securing AWS services, AWS secure architectures, application security, and cloud applications.

• Familiarity with software supply chain management and microservice architecture.

• Understanding of cloud environments, ideally AWS, and CI/CD pipelines.

• Knowledge of SOC 2, ISO 27002, PCI, and PII audit and compliance frameworks.

• Experience in reading and reviewing code.

• Proficiency or active development skills in JavaScript/TypeScript or Python is a plus.

• Excellent written and verbal communication skills.

• Willingness to travel 2–3 times per year to College Board offices in New York or Reston, Virginia.

• A strong passion for enhancing educational and career opportunities through mission-driven work.

• A sense of curiosity and enthusiasm for emerging technologies and AI-driven solutions.

• A learner’s mindset with a commitment to personal and professional growth.

• A collaborative and empathetic approach to teamwork.

• Authorization to work in the United States.

🏝️ Benefits

• Option for fully remote work.

• Hybrid work model for candidates located near College Board offices (in-office on Tuesdays and Wednesdays).

• Comprehensive compensation and benefits package.

• Salary adjusted based on location.

• Open and transparent discussions regarding compensation and benefits.

• A meaningful career with a supportive team.

• Opportunities for professional development through team learning events, industry conferences, and Hackathons.