Product Security Engineer

The Product Security Engineer will help make secure-by-default practices part of how teams design, build, and release product capabilities. This onsite role in New York focuses on high-ownership work across threat modeling, application security gates in CI/CD, vulnerability management, and secure SDLC standards.

Location and Compensation

• Location: New York, NY (onsite)
• Salary: USD 208,000 - 245,000 per year

Key Responsibilities

• Lead threat modeling and security design reviews for new services and features to identify and remediate design flaws before code ships.
• Architect and own SAST, SCA, and secrets-scanning gates within CI/CD pipelines, tuned to support engineer trust and actionability.
• Own the DAST program, including tool selection and coverage, and partner with teams to triage findings tied to affected services.
• Run product vulnerability management, including the CVE remediation workflow and associated SLAs, driving fixes across multiple engineering teams.
• Define and operationalize secure SDLC standards, enabling developers through guidance, tooling, and practical examples that reduce reliance on security review bottlenecks.
• Scope and coordinate penetration tests, then drive remediation of findings to closure with responsible teams.
• Define security requirements for customer-facing features and integrations, and mentor engineers on applying those requirements.

Required Qualifications

• Strong software engineering background, including experience building and reviewing production services in at least one modern language.
• Hands-on experience conducting threat modeling and security design reviews for distributed systems or cloud-hosted services.
• Experience operating application security tooling in CI/CD, including SAST, SCA, secrets scanning, and DAST.
• Experience running vulnerability management, including triage, prioritization by real exploitability, and remediation tracking against SLAs.
• Experience scoping penetration tests and working with testers and engineering teams to close findings.
• Proven record of writing security standards or requirements that engineering teams adopt in practice.
• Ability to lead cross-team work and make risk-based decisions amid ambiguity, influencing engineers without direct authority.
• Experience securing software deployed on-prem or in air-gapped environments.
• Familiarity with defense or aerospace compliance frameworks such as NIST 800-53 or NIST 800-171, or experience shipping software under ITAR or CUI constraints.
• Hands-on use of software supply chain security practices, including SBOM generation and artifact signing.
• Certified Kubernetes Security Specialist (CKS) certification, or equivalent hands-on experience securing Kubernetes workloads.
• Experience building a product security program from an early stage.

Technologies

• SAST, SCA, secrets-scanning, DAST
• CI/CD pipelines
• CVE remediation workflow
• Threat modeling, penetration tests
• SBOM generation, artifact signing
• Kubernetes
• NIST 800-53, NIST 800-171
• ITAR, CUI

Benefits

• 100% covered health, dental, and vision insurance (for you and your family)
• Unlimited paid vacation
• 12 weeks parental leave
• Fertility and family planning ($15,000 lifetime)
• Lunch provided daily
• Wellness stipend ($100/month)
• $500/year hardware sensor stipend
• Learning and development stipend
• 401(k)
• Employee-friendly equity terms
• In-office 5 days per week

ITAR Requirements

To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.