Staff Product Security Engineer

This is a fully remote position, open to applicants in Poland.

📋 Description

• Provide leadership and guidance in security within product engineering teams through developer-driven threat modeling and education on best practices for security and privacy.

• Oversee security requirements and standards throughout the entire product life cycle.

• Manage vulnerabilities, cryptography, security monitoring, and risk management controls within application-based products.

• Contribute to the development of Doxy.me’s DevSecOps security strategy and overall posture.

• Design, promote, and assist in the creation of secure-by-default CI/CD pipelines and processes.

• Create engineering reference implementations for security patterns and guardrails within software frameworks and the technology stack.

• Support and execute proofs of concept and implementations for security technology and control designs.

• Collaborate with Product and Engineering teams to ensure that product business cases incorporate functional security specifications.

• Ensure adherence to information security standards.

• Monitor risk, threat, and vulnerability metrics within the product environment.

• Prioritize and carry out remediation activities for application vulnerabilities.

⛳️ Requirements

• A Bachelor's degree in computer science, programming, or a related field, or equivalent job experience in lieu of a degree.

• Experience working with remote, globally distributed teams.

• Experience in organizations that develop software and/or manage infrastructure and technology services for their own clients.

• Familiarity with AWS platforms or services, or equivalent experience with Azure or GCP.

• Proficiency in Kubernetes and container infrastructure.

• Secure development and application of Infrastructure as Code (IaC) solutions, including Terraform and Helm.

• Experience with DevOps tools and processes, such as CI/CD.

• Knowledge of security testing tools, including static code analysis and DAST.

• Strong understanding of the OWASP Top 10, application security vulnerabilities, and web security testing methodologies.

• Familiarity with secure coding practices for compliance requirements within SOC2, ISO, HIPAA, HITRUST, etc.

• Ability to effectively give, receive, and respond to feedback.

• Capability to educate company employees on security measures.

• Strong communication skills in English and Ukrainian are highly desirable.

• Willingness to undergo a background check following the job offer.

🏝️ Benefits

• Remote-first company with regional hubs for in-person collaboration.

• Background checks conducted after extending a job offer.

• Opportunity to collaborate with a global team of technologists, academics, researchers, and innovators.