Staff Application & Product Security Engineer

Accountabilities:

• Own and continuously mature the secure software development lifecycle, including security requirements, threat modeling, design reviews, and security controls for high-risk product changes, APIs, and integrations.
• Run and optimize SAST, SCA, secrets detection, container, and infrastructure-as-code scanning across development and CI/CD environments.
• Build reusable secure patterns, reference implementations, and policy-as-code controls that make secure development practices easier for engineering teams to adopt.
• Lead developer security enablement through Security Champions programs, training campaigns, remediation guidance, office hours, and self-service security capabilities.
• Manage application and product vulnerabilities through risk-based triage, remediation SLAs, escalations, exceptions, exploit reproduction, patch validation, and release verification.
• Own the penetration testing program, including scoping third-party engagements, performing targeted testing, coordinating remediation, and validating findings through retesting.
• Manage the Vulnerability Disclosure Program and coordinate communications with external researchers, customers, and other stakeholders through coordinated disclosure processes.
• Coordinate the CVE lifecycle for products and support product-security incident response activities.
• Own application and product-security controls within the NIST CSF 2.0 program, tracking maturity, closing gaps, and producing audit evidence.
• Establish and maintain the security posture of products across SaaS and customer-hosted environments, including secure defaults, authentication, session controls, RBAC, tenant isolation, administrative access, configuration security, and hardening guidance.
• Own the Product Security Roadmap in partnership with Product Management, Technology leadership, and Architecture, ensuring priority security capabilities are incorporated into product development.
• Serve as the technical owner for customer-facing product security, including reviewing vulnerability scans and penetration-test reports, responding to security RFIs and enhancement requests, and preparing security advisories, release notes, and hardening documentation.
• Lead threat modeling and security reviews for LLM-enabled product features, AI agents, and AI-assisted development workflows.
• Develop security controls and secure patterns addressing prompt injection, sensitive data exposure, insecure output handling, excessive agency, insecure tool integrations, and AI supply-chain risks.
• Apply and operationalize relevant AI security frameworks and guidance, including the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework.

Requirements:

• 6+ years of experience in application security, product security, or secure software engineering, including experience building or maturing an AppSec program across multiple engineering teams.
• Strong software development capabilities in an object-oriented programming language, with Java experience preferred; ability to read, debug, and write production-quality code and work across languages such as TypeScript, Python, or Go.
• Deep understanding of modern application attack surfaces, including authentication, authorization, API security, business-logic vulnerabilities, and contemporary service architectures.
• Hands-on experience integrating and tuning SAST, SCA, and secrets scanning within GitHub and CI/CD pipelines.
• Demonstrated ability to reproduce security exploits against running applications, validate patches, and translate technical findings into actionable guidance for both researchers and customers.
• Experience coordinating vulnerability disclosure with external security researchers and customers, including managing disclosure timelines and driving CVEs through publication.
• Experience securing shipped software with an established customer base, including secure defaults, hardening guidance, customer advisories, security release notes, and responses to customer scan reports or security RFIs.
• Practical experience with threat modeling, architecture and design reviews, manual security testing, and direct collaboration with developers throughout remediation.
• Strong communication skills and the ability to translate complex technical risks into clear engineering guidance for developers and concise risk assessments for executives.
• Confidence making and defending release-gating security decisions when risk levels warrant escalation.
• Experience with AI application security, AI agents, or AI-assisted development tools is preferred.
• Familiarity with SBOM standards such as CycloneDX or SPDX, VEX, artifact signing, and SLSA is a plus.
• Experience with AWS, Kubernetes/EKS, Terraform, or Jenkins is beneficial.
• Familiarity with security tools such as Snyk, GitHub Advanced Security, Semgrep, and Burp Suite is preferred.
• Knowledge of NIST CSF 2.0, OWASP SAMM/ASVS, NIST SSDF, and security audit frameworks such as SOC 2 or ISO 27001 is advantageous.
• Security certifications such as CSSLP, OSWE, GWAPT, AWS Security, or comparable credentials are a plus.
• Experience with enterprise software supporting both SaaS and customer-hosted deployment models, including SSO/SAML, RBAC, multi-tenant isolation, MFT/EDI, or other B2B integration products, is beneficial.

Benefits:

• $160,000–$180,000 base compensation plus bonus opportunity.
• Healthcare, dental, and vision coverage.
• Flexible paid time off.
• Culture focused on support and sustainable work-life balance.
• 401(k) with company match.
• Flexible Spending Account (FSA) and Health Savings Account (HSA) options.
• Employee Assistance Program.
• Paid parental leave.
• Remote work environment.
• Opportunity to contribute to products serving more than 4,000 clients with a 99% retention rate.
• Accelerated opportunities for title and salary growth.
• Energetic and collaborative work environment.