Senior Product Security Engineer

WHAT YOU LL DO

• Collaborate and build relationships with the product and engineering teams
• Identify risks across all applications, and assist to mitigate these risks
• Assist in the development of a scalable threat modeling program (and conduct them as well!) for our applications, including the training of engineering teams to do the same.
• Review source code for potential security vulnerabilities and provide remediation guidance to engineers
• Develop, deploy and maintain various code and application security tools (such as SAST/DAST etc.) and their SOPs
• Develop, evaluate, and respond to alerts and events from the security tools
• Adopt automation to shift security to the left and make it scalable
• Triage, escalate, and offer remediation for the vulnerabilities found after risk assessment
• Be able to assist in occasional (but not normally expected) after hours security investigations when needed
• Be a humble mentor for our talented team members

WHAT YOU LL NEED:

• 9+ years of experience in an application security engineering or other similar role

• Extensive hands-on experience in performing manual and tool-assisted code reviews
• Extensive hands-on experience in integrating secure development practices into SDLC
• Extensive hands-on experience in integrating security tools in CI/CD pipelines
• Experience in Typescript, Python, Go or another programming language
• Experience in the development of security products or DevSecOps infrastructure
• Demonstrable knowledge of OWASP Top 10 and attack vectors
• Foundational understanding of container security and orchestration (Kubernetes, Docker)
• Familiarity with deployment automation tools such as Terraform, Helm, Atlantis, and BuildKite
• Familiarity with threat modeling
• Strong written and verbal communication skills
• Desire to build an application security program and coach junior engineers