Senior Product Security Engineer

Responsibilities

• Autonomously Drive AI Security Innovation:
  Proactively identify gaps in our current capabilities and independently architect, build, and deploy AI-driven solutions to automate code analysis, optimize triage, and scale Product Security workflows.
• Security Architecture & Threat Modeling:
  Lead deep-dive security reviews and complex threat modeling sessions across distributed systems, embedding strict security requirements into product designs before development begins.
• Product-Focused Vulnerability Management:
  Own the lifecycle of product security findings. Ensure vulnerabilities are accurately triaged, mapped to the correct engineering owner, and mitigated in alignment with established SLAs.
• Bug Bounty Leadership:
  Oversee the technical triage and validation of Cloudflare’s external Bug Bounty program, prioritizing submissions based on real-world exploitability and business risk.
• Pentest Strategy & Support:
  Shape the scope of internal and external penetration testing engagements, serving as the technical liaison to ensure findings are deeply understood and remediated by development teams.
• Strategic Influence & Mentorship:
  Act as a force-multiplier for security across Cloudflare; mentor junior engineers, cultivate security champions within engineering organizations, and establish modern, paved-road developer guardrails.

• Senior-Level Product/App Sec Expertise:
  Extensive, battle-tested experience in Product or Application Security within large-scale distributed cloud environments or SaaS platforms.
• Practical AI & Automation Engineering:
  Demonstrated ability to build production-grade automation scripts and tools . Must possess hands-on engineering experience leveraging AI/LLMs to solve operational or technical challenges.
• Advanced Threat Modeling & Risk Analysis:
  Mastery of threat modeling methodologies (e.g., STRIDE) and an analytical mindset capable of translating complex theoretical risks into prioritized, actionable business context.
• Vulnerability Lifecycle Ownership:
  Proven track record of managing, routing, and driving the remediation of vulnerabilities across multi-stakeholder engineering organizations while strictly enforcing SLAs.
• High Influence & Communication:
  Superb cross-functional leadership skills; the ability to confidently influence senior engineering leaders, resolve ownership ambiguity, and champion security initiatives without explicit authority.

Demonstrates extensive expertise in Product and Application Security, with a strong focus on AI-driven solutions and vulnerability management within large-scale distributed cloud environments. Proven ability to lead security architecture initiatives, mentor engineering teams, and influence cross-functional stakeholders effectively.

• Product/Application Security Expertise
• AI & Automation Engineering
• Threat Modeling Methodologies
• Vulnerability Lifecycle Management
• Cross-Functional Leadership

• AI-Driven Solutions
• Code Analysis Automation
• Threat Modeling
• Vulnerability Management
• Penetration Testing
• Automation Scripts
• Risk Analysis
• Security Architecture
• Cloud Environments
• SaaS Platforms

• Influence
• Mentorship
• Communication
• Leadership
• Collaboration

• Bug Bounty Program
• Security Workflows
• Engineering Ownership
• SLAs
• Distributed Systems