Product Security Engineer

Job Description

Position Type: Contractor, Full-time (1880 hrs. per year) 

\n

Position Location: Full remote, US-based 

\n

 

\n

General Responsibilities 

\n

Aedify and its customers are seeking a Product Security Engineer to support the Product Security Director and help deliver scalable product security capabilities across modern applications, APIs, cloud-native services, third-party products, desktop applications, and emerging AI-native development. 

\n

This is a hands-on role focused on identifying meaningful security risk, validating exploitability and business impact, partnering with engineering teams on remediation, and helping operationalize security testing throughout the product lifecycle. 

\n

\n

\n
• Product Security Testing – Design and execute risk-based manual and automated security testing for web and mobile applications, their backing APIs, cloud services, SaaS products, desktop applications, third-party integrations, and other product technologies. 
\n
• Pre-Production Security – Design and execute security testing within product delivery and release workflows, using application architecture, threat models, data sensitivity, exposure, and change risk to determine appropriate testing depth. 
\n
• Threat Modeling & Design Review – Lead or participate in threat modeling and secure design reviews, identify trust boundaries and attack paths, and translate design risks into actionable security requirements and testing objectives. 
\n
• Vulnerability Validation & Remediation – Analyze and validate security findings, assess severity and business impact, provide actionable remediation guidance, verify fixes, and support exception workflows where appropriate. 
\n
• Security Tooling & Automation – Implement and operationalize security testing capabilities such as DAST, API testing, SAST, SCA, secrets, cloud/container, and other relevant security tooling. Develop lightweight automation and integrations where useful. 
\n
• Specialized Product Security Assessment – Contribute expertise in one or more advanced areas such as AI/LLM security, cloud-native security, thick-client security, COTS/third-party assessment, software supply-chain security, or advanced application/API testing. 
\n
• Product Security Program Development – Help create reusable security standards, testing methodologies, engineering guidance, workflows, test cases, and metrics that allow Product Security services to operate consistently at enterprise scale. 
\n
• Cross-Functional Collaboration – Work across engineering, architecture, cloud, infrastructure, identity, networking, governance, vendor, and security teams to resolve technical and process blockers and drive security work through completion. 
\n

\n

Qualifications 

\n

\n
• Strong understanding of application/product security fundamentals, including manual security testing, API security, authentication and authorization, vulnerability analysis, threat modeling, and secure design. 
\n
• Demonstrated ability to independently navigate complex technical and organizational environments, resolve ambiguity, identify appropriate stakeholders, and drive security initiatives with limited supervision. 
\n
• Strong understanding of modern application architecture, including cloud services, APIs, identity, databases, distributed systems, and SaaS security principles. 
\n
• Ability to translate technical security findings into actionable engineering guidance and communicate risk effectively to technical and non-technical stakeholders. 
\n
• Ability to develop lightweight security automation, tooling, integrations, or test harnesses using technologies such as Python, PowerShell/Bash, APIs, YAML, and CI/CD systems. 
\n
• Hands-on experience with at least one major cloud platform such as Azure, AWS, or GCP is preferred. 
\n
• Working knowledge of emerging technologies and security risks affecting modern product development. 
\n

\n

 

\n

\n

Specialized Experience 

\n

Candidates should bring deeper hands-on experience in one or more of the following areas: 

\n

\n
• Web and API penetration testing 
\n
• DAST and automated application security testing 
\n
• Threat modeling and secure architecture 
\n
• Cloud-native and Kubernetes security 
\n
• AI/LLM and agentic application security 
\n
• Desktop/thick-client security 
\n
• COTS and third-party product security 
\n
• DevSecOps and security tooling automation 
\n
• Software supply-chain security 
\n

\n

\n

Experience with AI/LLM architectures such as RAG, model APIs, vector stores, agent/tool calling, or model-serving infrastructure is valuable but not required for every candidate. 

\n

Education & Experience 

\n

\n
• Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related field, or equivalent professional experience, certifications, training, and demonstrated technical expertise. 
\n
• 5+ years of relevant cybersecurity, software engineering, platform engineering, or product/application security experience, or equivalent demonstrated expertise. 
\n
• Demonstrated hands-on application/product security experience and depth in at least one relevant specialization. 
\n
• Software development, security automation, DevSecOps, or platform engineering experience is strongly preferred. 
\n

\n

 

\n

Familiarity with relevant security guidance such as NIST SSDF, NIST AI RMF, OWASP application/API ßand GenAI security guidance, MITRE ATLAS, SLSA, and applicable cloud-native security guidance is beneficial.