Senior Product Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of security design evaluations and threat modeling for high-risk product domains, including payment processing, identity and access management, fraud detection systems, and AI.

• Act as a technical security expert for both staff and principal engineers.

• Offer guidance on secure architectural patterns, cryptography, and API security.

• Lead and implement application security evaluations, red team exercises, and adversarial simulations in both production and pre-production settings.

• Establish and promote adherence to security standards, secure coding practices, and SAST/DAST/SCA tools.

• Collaborate with Engineering and DevOps to enhance the security framework of CI/CD pipelines, cloud infrastructure, and containerized environments.

• Convert intricate security risks into prioritized recommendations for engineering leaders and product managers.

• Contribute to compliance with regulations such as PCI-DSS, SOC 2 Type II, and other relevant regulatory frameworks.

• Assist in expanding security practices, tools, and frameworks throughout the organization.

⛳️ Requirements

• A minimum of 5 years of experience in application security, product security, or a similar technical role.

• Proven experience in application security, product security, or a closely related technical field.

• In-depth knowledge in at least two of the following areas: web application security, API security, mobile security (iOS/Android), or cloud security (preferably AWS).

• Strong command of one or more programming languages, such as Python, Java, or JavaScript.

• Familiarity with contemporary software development and application security tools, including SAST, DAST, and SCA.

• Practical experience with threat modeling methodologies applied to intricate distributed systems.

• Knowledge of regulations such as PCI-DSS, SOC 2 Type II, FFIEC, NIST CSF, and ISO 27001.

• Excellent written and verbal communication abilities suitable for both technical and business audiences.

• Preferred: experience in securing fintech, payment systems, or regulated financial products.

• Preferred: experience in supporting cloud-native architectures and modern CI/CD workflows.

• Preferred: experience in red team exercises, penetration testing, or adversarial simulations.

• Preferred: security certifications such as CISSP, CSSLP, OSCP, GIAC, or similar credentials.

• Preferred: experience collaborating closely with engineering teams in highly regulated environments.

🏝️ Benefits

• Bonus programs

• 401(k) match

• Employee Stock Purchase Program (ESPP)

• HSA and FSA options

• Financial wellness resources and employee discount programs

• Medical, dental, and vision coverage

• Mental health support for employees and dependents through Lyra Health

• Family planning and women’s health benefits through Carrot

• Gym membership reimbursement and virtual wellness programs (including yoga)

• 3 weeks PTO to start, with unlimited PTO after year one

• Education expense reimbursement

• Leadership development programs

• Certified Payments Professional (CPP) certification support