Senior Product Security

• Use agentic security systems, custom static analysis, manual review, and threat modeling to surface real risk
• Validate whether security findings can actually be triggered, manually or by extending automated tooling
• Reduce manual validation costs through engineering
• Author static analysis rules that block recurring vulnerability classes at pull-request time
• Contribute to the intake pipeline that graduates high-value findings into merge-blocking rules
• Advise on which findings meet the rule-worthy threshold
• Provide security consulting on difficult architectural questions
• Apply and extend the scoping methodology across products
• Partner directly with product engineering teams to identify, validate, and prevent vulnerabilities
• Deliver measurable impact through detections shipped, vulnerabilities closed, and systemic patterns eliminated

• 5+ years in security engineering, application security, or a directly adjacent role
• At least 2 years in a hands-on vulnerability-discovery capacity
• Deep familiarity with at least one major language ecosystem (Java, Python, JavaScript/Type Script, Go, Ruby, or similar)
• Ability to read and reason about code in other languages
• Working knowledge of static analysis tooling and custom rule authoring, tuning, and maintenance
• Experience with Semgrep, CodeQL, or equivalent
• Practical experience with threat modeling, authentication and authorization design, cloud security architecture, or supply chain security
• Ability to scope own work from a vague ask
• Excellent written and verbal communication
• A related technical degree required

Demonstrates expertise in security engineering and application security, with a strong focus on vulnerability discovery, static analysis tooling, and threat modeling. Capable of collaborating with product engineering teams to implement effective security measures and deliver measurable impact.

• Security Engineering
• Vulnerability Discovery
• Static Analysis Tooling
• Threat Modeling
• Java, Python, JavaScript/Type Script, Go, Ruby

• Static Analysis Rule Authoring
• Vulnerability Validation
• Code Review
• Security Consulting
• Cloud Security Architecture

• Excellent Written Communication
• Excellent Verbal Communication

• Related Technical Degree

• Application Security
• Threat Modeling
• Authentication Design
• Authorization Design
• Supply Chain Security

• Semgrep
• CodeQL