Principal Product Security Engineer

We offer a flexible working policy that supports a healthy balance between personal and professional well-being. This role requires in-office presence on Tuesdays & Thursdays to collaborate, connect, and learn from peers - while also maintaining the flexibility for meaningful work-life balance.

You will join this team of security engineers that will guide the global engineering teams on security considerations as well as assess and improve product security  operate on a Zero-Trust approach, so you will play an integral role in the continued maintenance and maturity of our Zero-Trust architecture. Our focus is to ensure that our engineers ship secure code and infrastructure, and we want your help to do it.

You are passionate about technology and willing to work with industry security perspectives including threat modeling, architecture review, dynamic code review, static code reviews, cloud assessments, data security assessments, runtime/event security, adherence to compliance as well as red team/blue team/purple team activities.

• Creating best practices, metrics and mechanisms to improve security testing methodologies within a SDLC.
• Analyzing emerging trends, news and changes in threat and compliance environment with respect to organizational risk.
• Advising organization management while developing and executing plans for compliance and mitigation of risk.
• Developing and communicating security training material for engineering and security champions.
• Mentoring team members, striving to consistently learn and improve within the company as well as sharing knowledge with colleagues.
• Communicating the security posture of applications and deployment environments internally to the organization and externally to customers of the system.

• A bachelor’s degree or higher in computer science or related field.
• 7-10+ years of relevant work experience.
• Extensive experience assessing risk and providing remediation guidance for vulnerabilities detected in one or more of the following perspectives:
  • SAST, SCA, DAST, host/container security, IaC, platform security, manual pen testing, cloud configuration, network security, data security, API security and CI/CD process
• Extensive experience of best practices, metrics and mechanisms to improve security testing methodologies.
• Proven experience and understanding of multi-tier web application architecture patterns.
• Extensive experience with software development practices, tooling and technologies.
• Curiosity and a desire to improve customer experience, reduce risk, improve methods and prepare for new threats.
• Ability and desire to communicate with colleagues to strategize and implement continual improvement through industry best practices, threat modeling and vulnerability triage.
• In-depth understanding of “OWASP Top 10” risks like injection, XSS, CSRF, etc.
• Understanding of data classification and data security control implementations.
• Extensive experience with common cloud security controls and best practices.
• Experience with measuring software security programs using BSIMM, SAMM, ASVS frameworks.

Don't meet every qualification listed above? Studies show that women and people of color are less likely to apply to jobs unless they…