Security Engineer, Product Security

Accountabilities: Define security architecture and strategy: Establish security architecture for products and services, developing reusable patterns and reference implementations that make secure-by-default development the easiest path for engineering teams. Lead security engineering reviews: Conduct and guide security reviews for high-risk product features, set consistent technical quality standards, and establish expectations for reviews conducted by other team members. Drive threat modeling and attack surface analysis: Lead domain-specific threat modeling and assess attack surfaces across the broader product environment, identifying architectural risks beyond individual features. Partner on technical decisions: Work with engineering leadership to evaluate and resolve complex security tradeoffs and guide secure product design. Strengthen vulnerability management: Set standards for triaging, reproducing, and prioritizing bug bounty submissions and internal security reports, while personally handling the most complex or highest-severity cases. Address systemic vulnerabilities: Drive remediation of recurring vulnerability classes and underlying security weaknesses rather than focusing solely on isolated findings. Own security services and tooling: Manage the security services and tools used by product engineering teams across global infrastructure. Develop security capabilities across engineering: Build and scale the security champions program and product security training, extending security knowledge and judgment throughout the engineering organization. Provide technical leadership: Mentor fellow security engineers and serve as a trusted technical authority on product security across engineering leadership. Participate in security operations: Contribute to the security on-call rotation and support work across security disciplines as needed. Requirements Typically 2–5 years of experience in product security, application security, or software development with a security focus. Demonstrated skills and practical work are valued more than an exact number of years. Strong understanding of web application security principles and common attack vectors, including the OWASP Top 10. Proficiency with application security testing tools such as Burp Suite, OWASP ZAP, or browser developer tools. Working knowledge of at least one modern programming language, such as Ruby, Java/Kotlin, TypeScript/JavaScript, or Python. Experience working with at least one major cloud provider, such as AWS, Google Cloud Platform (GCP), or Microsoft Azure. Ability to assess application and architectural risks, conduct threat modeling, and collaborate effectively with software engineers on secure design decisions. Comfort participating in a security on-call rotation and taking on responsibilities across different security disciplines when required. Strong communication and collaboration skills, with the ability to explain security risks, influence engineering decisions, and help teams adopt practical security practices. Nice to Have Hands-on experience working with bug bounty platforms. Familiarity with Static Application Security Testing (SAST) tools such as Cycode, Semgrep, Snyk, or similar solutions. Experience with cloud infrastructure security and container technologies. Participation in Capture the Flag (CTF) events or contributions to open-source security projects. Familiarity with threat modeling frameworks and secure software development lifecycle (SDLC) best practices. Interest or experience in contributing to internal developer security training programs. Benefits Competitive, location-based salary ranges: California: $130,950–$202,125 USD. Washington: $147,000–$183,750 USD. Colorado: $148,210–$163,688 USD. New York City: $147,000–$183,750 USD. Illinois: $148,210–$163,688 USD. Bonus and equity opportunities as part of the total rewards package. Comprehensive medical, dental, and other benefit offerings. Flexible time off. Remote work opportunity within the United States. Access to modern hardware and software, including advanced AI models from the first day. Collaboration with globally distributed teams through Slack, video calls, and asynchronous documentation. An agile working environment where teams have flexibility to determine the practices that best support their work. Opportunity to influence security standards and architecture across a large engineering organization, with close collaboration between platform, security, and infrastructure teams.