Product Security Analyst/Engineer

Location: Bay Area, CA (Hybrid)

Contract

Additional Details.

Our client is looking for a team to create a Search Engineering Pod (HC - 6). The Pod will act as the operational bridge between automated security scanning/remediation systems and product code owners. Their mission is to streamline threat modeling, eliminate triage noise, validate exploitability, verify automated patches, and drive open security issues to verified resolution.

Domain: Product / Application Security Engineering - specifically vulnerability management and secure code remediation (an AppSec / Product Security Engineering pod, not SOC/infra security). Adjacent domain needed: software engineering (the pod writes PoCs and reviews patches), plus light GRC for policy/exception handling.

Skill set required:

Bucket

What to hire for

Security fundamentals

CWE / CVE / OWASP Top 10, CVSS-style scoring, remediation SLAs, secure coding standards (input validation, boundary checks, memory safety)

Threat modeling

STRIDE / PASTA, trust boundaries, data flows, attack surface mapping for distributed / microservice systems

Hands-on coding

Working proficiency in at least two of C++, Go, Java, Python - read and write, not just read

Reproduction / PoC

Building minimal test harnesses, mocking dependencies, sandbox execution, cross-service runtime debugging; fuzzing and unit-test frameworks a plus

Code review / QA

Very high attention to detail - catching LLM hallucinations, regressions, off-by-one errors in agent-generated diffs; differential/patch validation

Tooling

SAST/DAST scanners, bug trackers, CI pipelines, Git-based code review flows

AI-adjacent

Experience debugging and prompt-tuning automated code-generation / agentic fixer tools

Soft skills

Stakeholder management with product code owners, driving fixes to closure, documentation discipline, judgment on when to escalate to FTE security leads

Sourcing profiles that fit:

• Product Security / AppSec Engineer (3 6 yrs) - covers threat modeling, triage, policy
• Security-minded SDE / SDET (2 5 yrs) - covers reproduction, PoC building, patch QA
• Vulnerability Management Analyst (2 4 yrs) - covers queue hygiene, severity assignment, exception reviews, SLA tracking

Overview:

The pod will act as the operational bridge between automated security scanning/remediation systems and product code owners. Their mission is to streamline threat modeling, eliminate triage noise, validate exploitability, verify automated patches, and drive open security issues to verified resolution.

Core Workstreams & Responsibilities

#	Workstream	Key Responsibilities	Primary Deliverables
1	Threat Modeling & Asset Profiling	Document trust boundaries, data flows, and architectural entry points for high-priority services. Maintain up-to-date threat profiles in centralized repositories.	Standardized threat model documentation. Service risk classification tags.
2	Vulnerability Triage & Policy Management	Review and filter findings generated by automated source and endpoint scanners. Classify severity and evaluate exception requests against security compliance policies.	Bug tracking queue hygiene. Policy-compliant severity assignments. Documented exception reviews.
3	Reproduction & PoC Validation	Construct minimal test environments and reproduction harnesses. Validate whether reported findings represent viable vulnerabilities vs. false positives.	Confirmed reproduction steps/notes attached to issue tickets. Fast-closed false positives.
4	Automated / Agentic Fixer Oversight & QA	Supervise and validate code patches generated by automated remediation agents. Execute unit and integration tests, inspect diffs for unintended regressions, and verify fix efficacy.	QA-approved, tested patch changelists ready for code owner review.
5	Product Team Coordination & Closure	Route validated patches to designated product team code owners. Shepherd fixes through code review and verify end-to-end deployment to production.	SLA-compliant issue closures. Production fix verification notes.

Skill Breakdown by Operational Workstream:

Workstream	Must-Have Technical Skills	Nice-to-Have / Advanced Skills
1. Threat Modeling	Understanding of architectural trust boundaries, attack surfaces, and data flows. Familiarity with structured threat modeling frameworks (e.g., STRIDE, PASTA).	Experience conducting threat model reviews for large distributed / microservice systems. Ability to translate abstract system designs into concrete threat scenarios.
2. Triage & Policy Management	Working knowledge of common vulnerability classifications (CWE, CVE, OWASP Top 10). Ability to interpret vulnerability scoring matrices and map findings to strict remediation SLAs.	Experience managing vulnerability queues and reviewing compliance exception requests. Familiarity with automated static/dynamic scanning tools.
3. Vulnerability Reproduction	Proficiency in reading and writing code in at least two core languages (C++, Go, Java, Python). Ability to set up local test harnesses, mock dependencies, and build minimal PoCs.	Practical experience with fuzz testing, unit test frameworks, and sandbox execution. Debugging complex runtime or logic errors across service boundaries.
4. Automated / Agentic Fixer QA	High attention to detail during code reviews (spotting hallucinations, regressions, off-by-one errors). Understanding of secure coding standards (input validation, boundary checking, safe memory access).	Experience debugging and prompt-tuning automated code generation tools. Familiarity with automated patch validation and differential testing.

Escalation & Governance Model:

Standard Operations (XWF): Day-to-day triage, vulnerability reproduction, policy-standard severity tags, agentic patch QA, and standard remediation tracking.

Escalations to FTE Security Leads:

Ambiguous or out-of-policy exception requests.

Architectural or multi-service redesigns required to resolve complex root causes.

Disputed severity classifications between product teams and policy rubrics.

Key Performance Indicators (KPIs)

Triage Turnaround Time: Initial triage and false-positive filtering completed within 24 48 hours of report ingestion.

Patch Quality Rate: High acceptance rate of QA-verified automated patches submitted to product owners (target: 90% landing without major revision).

Remediation Cycle Time: Reduction in overall time from initial finding to production deployment.