Product Security Engineer

Job Description

Position Type: Contractor, Full-time (1880 hrs. per year)

Position Location: Full remote, US-based

General Responsibilities

Aedify and its customers are seeking a Product Security Engineer to support the Product Security Director and help deliver scalable product security capabilities across modern applications, APIs, cloud-native services, third-party products, desktop applications, and emerging AI-native development.

This is a hands-on role focused on identifying meaningful security risk, validating exploitability and business impact, partnering with engineering teams on remediation, and helping operationalize security testing throughout the product lifecycle.

• Product Security Testing – Design and execute risk-based manual and automated security testing for web and mobile applications, their backing APIs, cloud services, SaaS products, desktop applications, third-party integrations, and other product technologies.
• Pre-Production Security – Design and execute security testing within product delivery and release workflows, using application architecture, threat models, data sensitivity, exposure, and change risk to determine appropriate testing depth.
• Threat Modeling & Design Review – Lead or participate in threat modeling and secure design reviews, identify trust boundaries and attack paths, and translate design risks into actionable security requirements and testing objectives.
• Vulnerability Validation & Remediation – Analyze and validate security findings, assess severity and business impact, provide actionable remediation guidance, verify fixes, and support exception workflows where appropriate.
• Security Tooling & Automation – Implement and operationalize security testing capabilities such as DAST, API testing, SAST, SCA, secrets, cloud/container, and other relevant security tooling. Develop lightweight automation and integrations where useful.
• Specialized Product Security Assessment – Contribute expertise in one or more advanced areas such as AI/LLM security, cloud-native security, thick-client security, COTS/third-party assessment, software supply-chain security, or advanced application/API testing.
• Product Security Program Development – Help create reusable security standards, testing methodologies, engineering guidance, workflows, test cases, and metrics that allow Product Security services to operate consistently at enterprise scale.
• Cross-Functional Collaboration – Work across engineering, architecture, cloud, infrastructure, identity, networking, governance, vendor, and security teams to resolve technical and process blockers and drive security work through completion.

Qualifications

• Strong understanding of application/product security fundamentals, including manual security testing, API security, authentication and authorization, vulnerability analysis, threat modeling, and secure design.
• Demonstrated ability to independently navigate complex technical and organizational environments, resolve ambiguity, identify appropriate stakeholders, and drive security initiatives with limited supervision.
• Strong understanding of modern application architecture, including cloud services, APIs, identity, databases, distributed systems, and SaaS security principles.
• Ability to translate technical security findings into actionable engineering guidance and communicate risk effectively to technical and non-technical stakeholders.
• Ability to develop lightweight security automation, tooling, integrations, or test harnesses using technologies such as Python, PowerShell/Bash, APIs, YAML, and CI/CD systems.
• Hands-on experience with at least one major cloud platform such as Azure, AWS, or GCP is preferred.
• Working knowledge of emerging technologies and security risks affecting modern product development.

Specialized Experience

Candidates should bring deeper hands-on experience in one or more of the following areas:

• Web and API penetration testing
• DAST and automated application security testing
• Threat modeling and secure architecture
• Cloud-native and Kubernetes security
• AI/LLM and agentic application security
• Desktop/thick-client security
• COTS and third-party product security
• DevSecOps and security tooling automation
• Software supply-chain security

Experience with AI/LLM architectures such as RAG, model APIs, vector stores, agent/tool calling, or model-serving infrastructure is valuable but not required for every candidate.

Education & Experience

• Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related field, or equivalent professional experience, certifications, training, and demonstrated technical expertise.
• 5+ years of relevant cybersecurity, software engineering, platform engineering, or product/application security experience, or equivalent demonstrated expertise.
• Demonstrated hands-on application/product security experience and depth in at least one relevant specialization.
• Software development, security automation, DevSecOps, or platform engineering experience is strongly preferred.

Familiarity with relevant security guidance such as NIST SSDF, NIST AI RMF, OWASP application/API ßand GenAI security guidance, MITRE ATLAS, SLSA, and applicable cloud-native security guidance is beneficial.