Staff Application & Product Security Engineer
Core
Staff-level individual contributor owning the secure software development lifecycle, product security posture, and security roadmap for SaaS and customer-hosted products.
Role type
Staff Application & Product Security Engineer
Builds
Secure software development lifecycle, reusable secure patterns, policy-as-code controls, and product security roadmap features.
Domain
Application security, product security, AI/LLM security, cloud infrastructure.
Required skills
Application security, product security, secure software engineering, object-oriented programming (Java preferred), SAST/SCA/secrets scanning, threat modeling, vulnerability management, penetration testing coordination, CVE lifecycle management, security enablement, NIST CSF 2.0, OWASP Top 10 for LLM Applications, NIST AI Risk Management Framework.
Preferred skills
LLM application security, AI agent security, SBOM formats (CycloneDX, SPDX, VEX), artifact signing, SLSA, AWS, Kubernetes/EKS, Terraform, Jenkins, Snyk, GitHub Advanced Security, Semgrep, Burp Suite, NIST SSDF, SOC 2, ISO 27001, CSSLP, OSWE, GWAPT, AWS Security.
Technologies
Java, TypeScript, Python, Go, AWS, Kubernetes, Terraform, Jenkins, GitHub, SAML, RBAC
Responsibilities
Own and mature the secure software development lifecycle; operate and tune security scanning tools; develop reusable secure patterns and policy-as-code controls; lead developer security enablement; manage risk-based triage and remediation of vulnerabilities; lead the penetration testing program; run the Vulnerability Disclosure Program; coordinate product CVE lifecycle; own the security posture of SaaS and customer-hosted products; own the Product Security Roadmap; serve as technical owner for customer-facing product security; lead threat modeling for LLM-enabled features.
Seniority
Staff, hands-on IC
