Want to know if this job is worth applying to?
United States
Remote only
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Engineer, Product Security based in the United States.
The Security Engineer, Product Security will help shape and strengthen the security architecture of a broad portfolio of products and services. This role focuses on embedding secure-by-default principles into product development through architecture guidance, threat modeling, vulnerability management, and developer enablement. You will lead security reviews for high-risk product features, establish reusable security patterns, and help engineering teams make informed architectural decisions. Beyond individual assessments, you will build scalable programs and tools that extend security expertise across a large, globally distributed engineering organization. Working closely with product, platform, infrastructure, and engineering teams, you will address systemic risks and improve security throughout the software development lifecycle. This is an opportunity to combine hands-on technical security work with meaningful influence over engineering standards, practices, and culture.
Define security architecture and strategy: Establish security architecture for products and services, developing reusable patterns and reference implementations that make secure-by-default development the easiest path for engineering teams.
Lead security engineering reviews: Conduct and guide security reviews for high-risk product features, set consistent technical quality standards, and establish expectations for reviews conducted by other team members.
Drive threat modeling and attack surface analysis: Lead domain-specific threat modeling and assess attack surfaces across the broader product environment, identifying architectural risks beyond individual features.
Partner on technical decisions: Work with engineering leadership to evaluate and resolve complex security tradeoffs and guide secure product design.
Strengthen vulnerability management: Set standards for triaging, reproducing, and prioritizing bug bounty submissions and internal security reports, while personally handling the most complex or highest-severity cases.
Address systemic vulnerabilities: Drive remediation of recurring vulnerability classes and underlying security weaknesses rather than focusing solely on isolated findings.
Own security services and tooling: Manage the security services and tools used by product engineering teams across global infrastructure.
Develop security capabilities across engineering: Build and scale the security champions program and product security training, extending security knowledge and judgment throughout the engineering organization.
Provide technical leadership: Mentor fellow security engineers and serve as a trusted technical authority on product security across engineering leadership.
Participate in security operations: Contribute to the security on-call rotation and support work across security disciplines as needed.
Typically 2–5 years of experience in product security, application security, or software development with a security focus. Demonstrated skills and practical work are valued more than an exact number of years.
Strong understanding of web application security principles and common attack vectors, including the OWASP Top 10.
Proficiency with application security testing tools such as Burp Suite, OWASP ZAP, or browser developer tools.
Working knowledge of at least one modern programming language, such as Ruby, Java/Kotlin, TypeScript/JavaScript, or Python.
Experience working with at least one major cloud provider, such as AWS, Google Cloud Platform (GCP), or Microsoft Azure.
Ability to assess application and architectural risks, conduct threat modeling, and collaborate effectively with software engineers on secure design decisions.
Comfort participating in a security on-call rotation and taking on responsibilities across different security disciplines when required.
Strong communication and collaboration skills, with the ability to explain security risks, influence engineering decisions, and help teams adopt practical security practices.
Nice to Have
Hands-on experience working with bug bounty platforms.
Familiarity with Static Application Security Testing (SAST) tools such as Cycode, Semgrep, Snyk, or similar solutions.
Experience with cloud infrastructure security and container technologies.
Participation in Capture the Flag (CTF) events or contributions to open-source security projects.
Familiarity with threat modeling frameworks and secure software development lifecycle (SDLC) best practices.
Interest or experience in contributing to internal developer security training programs.
Competitive, location-based salary ranges:
California: $130,950–$202,125 USD.
Washington: $147,000–$183,750 USD.
Colorado: $148,210–$163,688 USD.
New York City: $147,000–$183,750 USD.
Illinois: $148,210–$163,688 USD.
Bonus and equity opportunities as part of the total rewards package.
Comprehensive medical, dental, and other benefit offerings.
Flexible time off.
Remote work opportunity within the United States.
Access to modern hardware and software, including advanced AI models from the first day.
Collaboration with globally distributed teams through Slack, video calls, and asynchronous documentation.
An agile working environment where teams have flexibility to determine the practices that best support their work.
Opportunity to influence security standards and architecture across a large engineering organization, with close collaboration between platform, security, and infrastructure teams.
