Principal Engineer — Product & Application Security (San Mateo)

Company DescriptionOrganizations everywhere struggle under the crushing costs and complexities of “solutions” that promise to simplify their lives. To create a better experience for their customers and employees. To help them grow. Software is a choice that can make or break a business. Create better or worse experiences. Propel or throttle growth. Business software has become a blocker instead of ways to get work done.There’s another option. Freshworks. With a fresh vision for how the world works.Freshworks Inc. builds uncomplicated service software that delivers exceptional employee and customer experiences. Our people-first approach to AI eliminates friction, helping businesses reduce complexity, lower cost-to-serve, and deliver faster, more human support through enterprise-grade yet easy-to-use CX and IT solutions. Nearly 75,000 companies, including Bridgestone, New Balance, Nucor, S&P Global, and Sony Music, trust Freshworks to power their Employee Experience (EX) and Customer Experience (CX) operations.Fresh vision. Real impact. Come build it with us.Job DescriptionWe are looking for a Principal Engineer — Product & Application Security to be the top technical authority for how Freshworks builds secure software. As an IC6 Principal, you set the multi-year security technical vision for our products and platform, make the calls on our hardest security-architecture problems, and are the person the company relies on when the stakes are highest — across a multi-tenant SaaS estate serving 72,000+ customer accounts and hundreds of integrations.As Freshworks evolves from a suite of service products into an AI-first system of business intelligence — with autonomous agents, a Knowledge and Context Graph, and a growing agentic surface — the security bar must rise with it. This role goes beyond leading individual reviews and remediations: you define the secure-by-design paradigms, reference architectures, and organization-wide standards that determine how thousands of engineers ship, and you drive the strategic bets (AI/agent security, supply-chain integrity, zero-trust data protection) that keep Freshworks ahead of the threat curve.You will operate as a company-wide force multiplier — writing code and reference implementations, setting technical direction that outlives any single project, mentoring Staff and Senior Staff security engineers, and partnering directly with VP Engineering, the CISO organization, and product leadership to make security a durable competitive advantage.Key ResponsibilitiesSecurity Technical Vision & StrategyOwn the multi-year technical vision and architecture strategy for product and application security across all Freshworks products (Freshdesk, Freshservice, and the shared Platform), and drive alignment on it across engineering and the CISO organizationDefine the secure-by-design reference architectures, paradigms, and organization-wide standards (authN/authZ, tenant isolation, data protection, secrets, API security) that thousands of engineers build againstSet the strategic security agenda for the AI-first platform — securing the AI Agent Platform, Knowledge/Context Graph, and agentic workflows — anticipating threat classes before they reach productionAct as the final technical decision-maker and tie-breaker on the hardest, highest-risk security-architecture trade-offsProduct & Application Security EngineeringLead threat modeling and security design reviews for the most critical, cross-cutting, and highest-risk systems — including identity and access, the integrations/connector framework (300+ apps), and the agent runtimeSet the standard for secure code review, manual and AI-assisted penetration testing, and vulnerability analysis; drive root-cause remediation strategies that eliminate whole vulnerability classes across the estate, not one bug at a timeArchitect and harden multi-tenant security controls: strict tenant isolation, authentication/authorization models, secrets management, data protection, and API gateway securityOwn the security design for AI/agentic features — prompt injection defense, tool-invocation authorization, non-human identity, and permission-scoped context accessLeft-Shift & Secure SDLC at ScaleDefine the organization-wide, AI-assisted left-shift strategy: how SAST, DAST (e.g., Snyk), SCA/dependency scanning, secret detection, and IaC scanning are embedded across every CI/CD pipeline to catch issues before productionSet the direction for security tooling, automation, and paved-road frameworks and libraries that make the secure path the default path — including code-component asset inventory (API/SBOM/RBAC/secrets/integrations) and secure-by-default product hardeningOwn the software supply-chain security strategy: centralized software artifact repository management (e.g., Sonatype Nexus), code artifact repository guardrails, and CI/CD pipeline hardeningEstablish secure coding standards, golden patterns, and guardrails; operationalize threat modeling and maturity models (SAMM) across the product portfolio; and define the security quality gates the whole org is measured againstVulnerability Management & Incident ResponseServe as the top technical escalation point for the most severe security incidents — leading investigation, containment strategy, and post-incident architectural hardeningSet the risk-based prioritization framework for findings from internal testing, bug bounty, third-party pen tests, and researcher disclosures, and drive systemic fixesShape the strategy for the bug bounty and responsible-disclosure programTechnical Leadership & InfluenceAct as the recognized top IC authority for product security — mentoring and multiplying Staff and Senior Staff engineers and security champions, and raising the security bar across the entire engineering organizationInfluence company-level strategy: advise VP Engineering, the CISO organization, and product leadership; represent Freshworks' product-security posture to enterprise customers, auditors, and (where appropriate) the external security communityDrive cross-organizational security initiatives to completion through technical credibility and clarity — building consensus across many teams without formal authoritySecurity Domains You'll Set Direction OnYou will be expected to provide deep technical direction — and roll up your sleeves — across the full product security roadmap, including:Compliance & trust enablement: internal and external pen testing (PCI vault, VAPT), Google CASA, TX-RAMP control validation, SDLC documentation control reviews, audit evidence, risk assessment prioritization, and new-product-introduction (NPI) security assessmentsContinuous security assessment & automation: DAST onboarding for public APIs and continuous-deployment integration, SCA bug triage, CI/CD environment assessment, continuous control monitoring, security scorecards, and anomaly-detection rule configurationShift-security-left: code-component asset inventory (API/SBOM/RBAC/secrets/integrations), supply-chain attack prevention, threat-modeling operationalization, and product-security maturity models (SAMM)Product security features: step-up authentication for sensitive operations, SCIM/secure SAML, OIDC federated SSO, OAuth for APIs and third-party apps, secrets injection, customer data masking, field-level encryption, BYOK, DNSSEC, header hardening (CSP/X-Frame), IMDSv2, egress proxy enforcement, hardcoded-secret cleanup, IAM role right-sizing, SIEM audit-log integration, and SSPM tool integrationMetrics & ImpactDefine the security KPIs the organization is held to: reduction in high/critical findings reaching production, coverage of critical services by threat models, mean time to remediate, and adoption of secure-by-default frameworksDeliver a measurable, sustained reduction in exploitable risk across the entire product portfolio while improving — not slowing — engineering velocityQualificationsProfessional Experience12+ years in software engineering and/or security, with deep, sustained hands-on ownership of application/product security for production SaaS at enterprise scaleTrack record as a Principal-level (or equivalent) individual contributor whose technical vision and standards shaped an entire engineering organization — you have defined direction that outlived individual projectsDeep experience securing multi-tenant, cloud-native SaaS platforms (ideally on AWS), including tenant isolation, authN/authZ, and API security at scaleDemonstrated impact eliminating vulnerability classes and setting the security frameworks, reference architectures, or paved roads adopted org-wideTechnical ExpertiseAuthoritative, current knowledge of application security anchored in OWASP frameworks — Web Top 10, API Security Top 10, ASVS, the LLM Top 10, and the newer OWASP Agentic AI Top 10 (the real-world attack classes targeting autonomous agents) — plus secure design patterns, authentication/authorization (OAuth 2.0, OIDC, SAML, SCIM), session management, and cryptographyMastery of threat modeling (e.g., STRIDE), secure code review, and both manual and AI-assisted penetration testing across web, API, and cloud surfacesDeep experience embedding security into CI/CD at scale: SAST, DAST (e.g., Snyk, Snyk Code), SCA, secret scanning, IaC scanning, artifact-repository management (e.g., Sonatype Nexus), and container/Kubernetes security aligned to the OWASP Kubernetes Top Ten (RBAC, workload isolation, supply-chain, and misconfiguration risks)Strong coding ability in one or more of Ruby, Java, Go, Python, or JavaScript/TypeScript — enough to build reference implementations and security tooling and to be credible in any code reviewDeep cloud security expertise (AWS preferred): IAM and role right-sizing, network/egress controls, KMS/secrets management, BYOK/field-level encryption, and infrastructure-as-code (Terraform/CloudFormation)Authoritative grasp of cryptographic and compliance standards r