Senior Security Engineer, Product Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of the application security toolchain, encompassing SAST, SCA, container and secret scanning, and DAST.

• Develop security automation using Python or TypeScript along with GitHub Actions.

• Execute policy-as-code checks, automate triage processes, and manage fix pull requests.

• Conduct threat modeling and design reviews for services and AI features.

• Assess high-risk pull requests.

• Collaborate with Security early in the development of new products, significant changes, AI features, and customer deployments.

• Work closely with Engineering and Forward Deployed Engineering teams on design and remediation efforts.

• Represent Product Security during customer security assessments.

• Minimize engineering friction while facilitating prompt security remediation.

• Define the scope of penetration tests, validate findings, and confirm fixes.

• Assess AI security tools and guide engineers on securing LLM, LLM Gateway, MCP, RAG, and agent patterns.

• Maintain SDLC and vulnerability management protocols to ensure SOC 2 compliance.

• Participate in the security on-call rotation.

• Develop scalable security testing, software supply-chain security, AI security guardrails, vulnerability intake processes, and product security metrics.

⛳️ Requirements

• Minimum of 6 years in software or security engineering, with at least 3 years focused on application or product security.

• Proven production coding experience in Python, TypeScript, Go, or Java.

• Practical experience with GitHub Actions at scale, encompassing reusable workflows, OIDC, secrets, and self-hosted runners.

• Familiarity with pipeline attacks and defenses, including poisoned pipeline execution, dependency confusion, compromised actions, pinning, SBOMs, artifact signing, and SLSA.

• Experience managing SAST and SCA programs across multiple repositories and developing custom rules.

• Hands-on experience with penetration testing for web applications and APIs.

• Experience with authenticated DAST.

• Strong understanding of OWASP Top 10 and API Security Top 10.

• Practical experience in securing LLM applications or agents against prompt injection, data leakage, insecure output management, and excessive agency.

• Regular use of AI coding assistants.

• Structured threat modeling and secure design review experience using STRIDE and/or MAESTRO.

• Hands-on cloud security experience with AWS, GCP, or Azure, including identity and access management, network controls, containers, and infrastructure as code.

• Experience working closely with engineering teams to implement fixes within their codebases.

• Ability to influence without direct authority, articulate risk in business terms, compose clear documentation, and take ownership of outcomes from start to finish.

🏝️ Benefits

• Performance-based bonuses may be available.

• Equity awards may be offered.

• Comprehensive health, dental, and vision coverage.

• Flexible time off and holidays.

• 401(k) plan with company matching.

• Disability and life insurance.

• Leaves of absence in accordance with relevant laws, regulations, and company policies.

• Flexible work model, allowing roles to be performed from anywhere in the country.

• AI-integrated daily work environment.