Product Security Engineer

About the Role

We are seeking a motivated and technically skilled Product Security Engineer to help strengthen and scale our Product Security program across a diverse portfolio of products and operating companies. This role will be responsible for managing key application security tools, supporting secure software development practices, driving product security metrics and reporting, and partnering with engineering teams to integrate security throughout the Software Development Lifecycle (SDLC). A significant focus of this position will be helping to normalize AI Security within existing Product Security processes, ensuring AI-enabled products and services are developed, assessed, measured, and governed using consistent security standards.

Key Responsibilities

• Product Security
• Partner with software engineering, architecture, DevOps, cloud, and product teams to integrate security throughout the SDLC.
• Support secure design reviews, threat modeling, vulnerability management, and remediation activities.
• Provide guidance and consultation on secure software development practices.
• Assist operating companies in adopting and maturing Product Security standards and processes.
• Support product security assessments for new technologies, platforms, services, and applications.
• Security Tool Ownership and Administration
• Serve as a primary administrator and subject matter expert for application security tooling, including:
• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Software Composition Analysis (SCA)
• Software Bill of Materials (SBOM) generation and management
• Container security scanning
• Dependency and supply chain security tools
• Secrets detection and related security technologies
• Support onboarding, configuration, maintenance, and optimization of security platforms.
• Work with engineering teams to integrate security tooling into CI/CD pipelines and development workflows.
• Evaluate new security technologies and recommend improvements to the Product Security tool ecosystem.
• Metrics, Reporting, and Governance
• Partner with operating companies to collect, validate, analyze, and report Product Security metrics.
• Develop and maintain dashboards, scorecards, and executive reporting.
• Track and report on key metrics including:
• SAST coverage
• DAST coverage
• SCA adoption
• SBOM generation and availability
• Vulnerability remediation performance
• Security testing coverage
• Secure development compliance
• Product Security program maturity
• Identify trends, risks, gaps, and opportunities for continuous improvement.
• Support monthly, quarterly, and annual Product Security reporting activities.
• AI Security Integration
• Help define and operationalize AI Security requirements and controls within the SDLC.
• Partner with engineering teams developing AI-enabled products and services to promote secure AI development practices.
• Assist in establishing AI Security metrics, monitoring, and reporting capabilities.
• Support governance activities related to AI risk management, model security, data protection, prompt security, and responsible AI practices.
• Drive the integration of AI Security controls, governance requirements, testing approaches, and metrics into existing Product Security processes, ensuring AI-enabled products are evaluated, measured, and reported using the same disciplined approach applied to traditional software security programs.
• Automation and Continuous Improvement
• Develop scripts and automation capabilities to improve Product Security workflows, data collection, reporting, and operational efficiency.
• Support integrations between security tools, source control platforms, and reporting systems.
• Contribute to the development of repeatable processes, documentation, standards, and operational procedures.
• Assist with internal audits, customer security reviews, and compliance activities as required.

Requirements & Tech Stack

• Strong understanding of software development principles and Software Development Lifecycle (SDLC) practices.
• Knowledge of application security concepts, secure coding practices, and vulnerability management.
• Familiarity with application security technologies including:
• SAST
• DAST
• SCA
• SBOM generation and management
• Container and dependency scanning
• Secrets detection and related security tools
• Strong analytical, troubleshooting, and problem-solving skills.
• Strong written and verbal communication skills with the ability to engage effectively with both technical and non-technical stakeholders.
• Ability to work collaboratively across multiple teams and operating companies.
• Preferred: Experience supporting or administering application security platforms such as Veracode, Snyk, CodeSonar, or similar technologies.
• Preferred: Experience with cloud platforms including AWS, Microsoft Azure, and Google Cloud Platform (GCP).
• Preferred: Familiarity with GitHub, GitHub Enterprise, GitHub Actions, and modern CI/CD development practices.
• Preferred: Experience developing scripts and automation using Python, PowerShell or similar technologies.
• Preferred: Familiarity with AI security concepts, secure AI development practices, and AI governance frameworks.
• Preferred: Experience creating security dashboards, metrics programs, and executive-level reporting.
• Preferred: Knowledge of OWASP Top 10, EU AI, CVSS, NIST Secure Software Development Framework (SSDF), and modern application security best practices.
• Preferred: Relevant industry certifications such as CISSP, CSSLP, GSEC, GWAPT, Security+, or equivalent are desirable.

Qualifications

• Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, Information Technology, or a related technical discipline.

Success Factors

• Passion for securing modern software products and emerging AI technologies.
• Strong ownership mindset and ability to manage initiatives with minimal supervision.
• Ability to build effective relationships across engineering, product, and security teams.
• Data-driven approach to measuring security performance and driving continuous improvement.
• Ability to translate technical security findings into actionable business insights.
• Commitment to helping teams deliver secure, resilient, and trusted products at scale.

This position is also eligible for bonus as part of the total compensation package.