Senior Product Security Engineers

Senior Product Security Engineer

Remote in USA
Were hiring a

Senior

Product Security Engineer

to work hand-in-hand with developers to secure the product across its entire lifecycle. Youll be the person who makes our platform defensible — through design reviews, threat modeling, hands-on penetration testing, and secure-coding partnership — and youll do it as a collaborator who helps engineers ship securely, not a gatekeeper who slows them down.
This role partners closely with product engineering and platform engineering teams.
Partner directly with developers to secure the product across the Software Development Life Cycle (SDLC), embedding security early rather than bolting it on at the end.
Perform hands-on penetration testing of web applications and Application Programming Interfaces (APIs), and translate findings into clear, prioritized, fixable work.
Conduct secure code reviews and help define secure-coding standards and security acceptance criteria.
Operate and tune Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and dependency / supply-chain scanning, and triage what they surface.
Help engineers understand the "why" behind findings so the same class of issue doesnt recur.
A strong track record in product or application security — youve measurably made real products more secure.
Hands-on penetration testing experience against web applications and APIs.
Deep understanding of how modern web applications work — single-page front ends, APIs, authentication and authorization (for example, OAuth 2.0 / OpenID Connect), sessions, and the common ways each is attacked (for example, the Open Worldwide Application Security Project, or OWASP, Top 10).
Solid understanding of the SDLC and how to embed security into it.
Strong communication skills — you work directly with developers and can explain risk in terms theyll act on.
Familiarity with open-source security tooling (for example, OWASP ZAP and Burp Suite Community Edition for testing, Semgrep for SAST, Trivy or Grype for dependency and container scanning, Nuclei for templated scanning).
Cloud security experience (Amazon Web Services, Microsoft Azure, or Google Cloud Platform) and container / Kubernetes security.
Experience supporting a SOC 2, International Organization for Standardization (ISO) 27001, or similar program.
Background in enterprise or regulated environments where deployment security is non-negotiable.
Youve reviewed the products architecture and threat surface and identified the highest-priority security risks.
Remote in Brazil or LATAM