Senior Principal Product Security Engineer

Role Description

We are seeking a hands-on Full Stack Developer to design, build, and continuously evolve a suite of internal security tools and platforms — including:

• Vulnerability Management (VM)
• Web Application Security (WAS) scanning orchestration
• SAST/SCA/DAST integrations
• Threat intelligence aggregation
• Asset and attack-path modeling
• Secure SDLC tooling

The successful candidate will engineer scalable, well-tested, end-to-end web applications that empower security engineers, developers, and risk stakeholders across the organization to identify, triage, and remediate security risk faster. You will work at the intersection of application engineering and security engineering, embedding security automation into developer workflows and cloud platforms.

Qualifications

• Bachelor's or Master's degree in Computer Science, Software Engineering, Cybersecurity, or a related discipline — or equivalent professional experience.
• 7+ years of professional software engineering experience building production web applications end-to-end.
• Strong proficiency in React (preferred) with TypeScript, modern CSS, and component libraries.
• Strong proficiency in Python (FastAPI/Django/Flask) — preferred for this role.
• Solid REST API design (OpenAPI-first), authentication and identity standards (OAuth 2.0, OIDC, JWT).
• Proficiency with PostgreSQL (or MySQL) and at least one of OpenSearch/Elasticsearch, MongoDB, or Redis.
• Experience with event-driven systems and message brokers (Kafka, SQS, RabbitMQ, Pub/Sub).
• Strong fundamentals in data structures, algorithms, system design, and software engineering best practices.
• Hands-on experience with Git, modern CI/CD, containerization (Docker), and at least one cloud platform (AWS, Azure, or GCP).
• Hands-on experience with GitHub Actions for CI/CD pipeline development and Argo CD for GitOps-based continuous delivery to Kubernetes.
• Working knowledge of OWASP Top 10 / OWASP ASVS.
• Understanding of the Vulnerability Management lifecycle.
• Familiarity with common security testing tools.
• Hands-on experience with durable workflow.
• Understanding of Secure SDLC principles.

Requirements

• Experience designing for large-scale finding/telemetry data.
• Hands-on experience implementing or consuming cloud security controls.
• Familiarity with policy-as-code authorization engines.
• Experience integrating security tooling with CI/CD pipelines.
• Familiarity with CSPM/CNAPP tools and CWPP concepts.
• Exposure to compliance frameworks such as SOC 2, ISO 27001, PCI-DSS, FedRAMP, NIST SSDF, or NIST 800-53.
• Understanding of supply-chain security concepts.

Benefits

• Innovative and dynamic team environment.
• Opportunities for education and training.
• Recognition as one of America's Best Midsize Employers by Forbes.
• Best Place to Work by Glassdoor.
• Top Workplace by The Washington Post.
• Best Place to Work in Asia by World HRD Congress.