Product Security Engineer

Job Title: Senior Product Security Engineer

Location: Remote, United States

Employment Type: Contract-to-Hire

Workplace Type: Remote

About the Role

We are seeking a Senior Product Security Engineer to help ensure the security of products and services from conception through launch and beyond. This role will play a key part in embedding security into the software development lifecycle, strengthening application security processes, and partnering closely with Engineering, Product, and Platform teams to protect customer data.

The ideal candidate has strong hands-on experience across Product Security, Application Security, secure SDLC practices, web and mobile application security, AWS cloud security, and modern AppSec tooling.

Responsibilities

• Support the development and execution of a comprehensive product security strategy aligned with company goals and risk appetite.
• Foster a culture of security awareness and ownership across Engineering and Product teams.
• Integrate security best practices and automated tooling throughout the SDLC, from design and threat modeling through testing and deployment.
• Establish and enforce secure development standards, including API security, secure coding practices, IaC security, and related best practices.
• Oversee application security activities including SAST, DAST, SCA, IAST, runtime scanning, and manual penetration testing.
• Partner with Engineering, Product, and Platform teams to prioritize and remediate security vulnerabilities efficiently.
• Establish and manage mature incident response processes for product-related security events and vulnerabilities.
• Partner with engineering teams to enhance product security features.
• Stay current with emerging threats, vulnerabilities, tools, and industry best practices to continuously improve security controls and processes.

Required Qualifications

• 6–8+ years of experience in Product Security, Application Security, DevSecOps, or a related security engineering discipline.
• Deep technical knowledge of web and mobile application security, common vulnerabilities, OWASP Top 10, and secure coding practices.
• Deep technical knowledge of CI/CD pipelines and relevant tooling for web and mobile applications.
• End-to-end experience implementing and managing Product Security tools and processes, including API Security, Mobile Protection, SAST, runtime scanning, or similar tooling.
• Hands-on experience with security tools for SAST, DAST, IAST, and penetration testing.
• Strong understanding of cloud security principles in AWS environments.
• Experience partnering with Engineering, Product, and Platform teams to prioritize, explain, remediate, and retest security vulnerabilities.
• Excellent communication skills with the ability to explain complex security concepts to both technical and non-technical audiences.
• Comfortable working in a fast-paced environment.

Preferred Qualifications

• Experience with security tools such as Burp Suite, Metasploit, Kali Linux, Postman, or similar.
• Background in financial services, fintech, or highly regulated industries.
• Hands-on certifications such as OSCP, Certified Ethical Hacker, SANS/GIAC, or similar.
• Demonstrated code projects, GitHub, public code samples, or public security work.

Benefits (w2):

• Health insurance
• Health savings account
• Dental insurance
• Vision insurance
• Flexible spending accounts
• Life insurance
• Retirement plan

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.