Staff Security Engineer, Product Security

Accountabilities: Define security architecture and strategy: Establish security architecture for products and services, creating scalable patterns and reference implementations that make secure-by-default development the easiest path for engineering teams. Lead security engineering reviews: Drive security reviews for the highest-risk product features and establish technical quality standards that guide reviews across the wider engineering organization. Lead threat modeling and attack surface analysis: Assess product domains and broader attack surfaces, identifying architectural risks beyond individual features and helping teams address them early in the design process. Guide complex engineering decisions: Partner with engineering leadership to evaluate and resolve significant security and architectural tradeoffs. Establish vulnerability management standards: Set expectations for triaging, reproducing, and prioritizing bug bounty submissions and internal security reports, personally handling the most challenging or highest-severity cases when needed. Drive systemic remediation: Identify recurring vulnerability patterns and lead initiatives to address underlying security weaknesses rather than isolated findings. Build and own security services and tooling: Develop and maintain security services and tools consumed by product teams across global infrastructure, applying hands-on software engineering expertise. Scale developer security enablement: Build and expand the security champions program and product security training, extending security knowledge and sound technical judgment across engineering teams. Provide technical leadership and mentorship: Mentor security engineers and help develop them into senior technical contributors while serving as an authoritative product security voice across engineering leadership. Lead cross-team technical initiatives: Establish reusable approaches and practices that improve security consistency across multiple teams, products, and services. Requirements Typically 8+ years of experience in product security, application security, or a related field, including substantial hands-on experience building security tools and services rather than focusing exclusively on reviews. Demonstrated capabilities and work are valued more than an exact number of years. Proven track record designing security architecture that scales across multiple teams, products, and services, rather than securing only an individual application. Strong understanding of web application security principles and practical experience using application security testing tools such as Burp Suite, OWASP ZAP, or similar solutions. Software development experience building security tools and services in at least one modern programming language, such as Go, Python, Java/Kotlin, TypeScript, or Ruby. Demonstrated ability to lead complex technical initiatives involving multiple engineering teams and drive adoption of shared security standards. Experience mentoring engineers and supporting their progression into senior technical roles. Strong architectural judgment and threat-modeling capabilities, with the ability to identify security risks and work collaboratively with engineering teams on practical solutions. Excellent communication and collaboration skills, including the ability to influence technical decisions across teams and explain security concepts to varied stakeholders. Nice to Have Experience establishing, managing, or scaling a security champions program. Knowledge of identity management and identity federation technologies, including SAML, OAuth, and SCIM. Experience with IaaS cloud infrastructure, Kubernetes, container technologies, and service-oriented architectures. Hands-on experience with bug bounty platforms and Static Application Security Testing (SAST) tools such as Cycode, Semgrep, Snyk, or similar. Experience conducting code audits of internal or open-source libraries before they are released into production. Benefits Competitive, location-based salary ranges: California: $148,210–$270,703 USD. Washington: $196,875–$270,703 USD. Colorado: $148,210–$185,263 USD. New York City: $196,875–$270,703 USD. Illinois: $148,210–$185,263 USD. Bonus and equity opportunities as part of the total rewards package. Comprehensive medical and dental benefits. Flexible time off. Remote work opportunity within the United States. Access to modern hardware and software, including advanced AI models from the first day. Collaboration with globally distributed teams through Slack, video calls, and asynchronous documentation. An agile working environment where teams have flexibility to determine the practices that best support their work. Opportunity to shape security architecture and standards across hundreds of engineers. Close collaboration with platform, security, and infrastructure teams, with security treated as an engineering discipline supported by strong technical quality standards.