Staff Product Security Engineer, AI Security & Security Assurance

Overview

Medallia is the pioneer and market leader in Experience Management. Our award-winning SaaS platform, Medallia Experience Cloud, leads the market in the management of experiences, insights, and actions for candidates, customers, employees, patients, and residents alike.

We believe that every experience is a memory that can last a lifetime. Experiences shape the way people feel about a company. And they greatly influence how likely people are to advocate, contribute, and stay. At Medallia, we are committed to creating a world where organizations are loved by their customers and their employees.

We empower exceptional people to create extraordinary experiences together.

Bring your whole self.

We are seeking an experienced Staff Product Security Engineer to help drive security across our products and platforms. This individual will serve as a senior technical contributor within Product Security, partnering closely with Engineering, Product, Architecture, and other Security teams to identify risks, design practical security solutions, and embed security throughout the software development lifecycle.

The ideal candidate combines strong hands-on application and product security expertise with the ability to independently lead complex security initiatives. They will help establish scalable security patterns, improve security automation, guide engineering teams through complex security decisions, and mentor other security engineers.

This is a highly technical individual contributor role with significant cross-functional influence.

• Lead security reviews for complex products, features, services, and architectures.
• Perform threat modeling and identify security risks early in the product development lifecycle.
• Partner with engineering teams to design practical mitigations and secure architecture patterns.
• Provide technical guidance on application, API, cloud, platform, and AI security.
• Serve as a security partner for major engineering initiatives from design through production.

• Help evolve and scale Product Security controls throughout the SDLC.
• Embed security into developer workflows through automated and developer-friendly security controls.
• Develop reusable security standards, patterns, guidelines, and reference architectures.
• Identify opportunities to shift security reviews earlier into requirements, design, and development.
• Drive adoption of secure-by-default engineering practices.

• Analyze and prioritize vulnerabilities based on exploitability, reachability, business impact, and customer risk.
• Partner with engineering teams to develop effective remediation strategies.
• Lead investigation of complex or high-impact product security vulnerabilities.
• Identify systemic vulnerability patterns and drive broader remediation rather than addressing findings individually.
• Provide technical input for risk acceptance and security exception decisions.

• Help design, implement, and optimize security capabilities including:
  • SAST
  • SCA
  • Secrets Detection
  • DAST
  • Container and Cloud Security
  • ASPM platforms
  • AI-assisted security reviews
• Automate repetitive security activities and reduce reliance on manual reviews.
• Improve developer experience by integrating security controls directly into engineering workflows.
• Develop meaningful metrics for security coverage, adoption, prevention, and remediation.

• Perform security reviews of GenAI and AI-enabled products.
• Assess risks associated with LLMs, AI agents, MCP integrations, tool invocation, and emerging AI architectures.
• Help develop security standards and reusable patterns for AI-enabled applications.
• Partner with engineering teams to integrate security controls into AI development workflows.

• Independently lead Product Security initiatives involving multiple engineering teams.
• Build strong partnerships with Engineering, Product, Architecture, Privacy, Compliance, and Security teams.
• Influence technical decisions through security expertise and practical recommendations.
• Mentor Product Security Engineers and help strengthen technical capabilities across the team.
• Represent Product Security in architecture reviews, technical discussions, and customer security engagements.

Candidates based in the Tysons Corner vicinity will be prioritized as this role is Hybrid, 3 days per week onsite.

• 8+ years of experience in application security, product security, security engineering, or related fields.
• Strong hands-on experience with:
  • Application Security
  • Secure Software Development Lifecycle (SSDLC)
  • Threat Modeling
  • Security Architecture Reviews
  • Vulnerability Management
  • Secure Coding Practices
• Experience securing modern application architectures including APIs, microservices, Kubernetes, containers, and cloud-native services.
• Experience with public cloud environments, preferably AWS.
• Experience with application…