Senior Security Engineer, Product Security
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Senior Security Engineer securing Komodo Health’s healthcare data platform, software supply chain, and AI features. Automating product-security testing and remediation across US-based engineering teams.
Responsibilities:
- Own the application security toolchain, including SAST, SCA, container and secret scanning, and DAST
- Build security automation in Python or TypeScript and GitHub Actions
- Implement policy-as-code checks, automated triage, and fix pull requests
- Run threat models and design reviews for services and AI features
- Review high-risk pull requests
- Engage Security early across new products, major changes, AI features, and customer deployments
- Partner with Engineering and Forward Deployed Engineering teams on designs and fixes
- Represent Product Security in customer security reviews
- Reduce engineering friction and support timely security remediation
- Scope penetration tests, validate findings, and verify fixes
- Evaluate AI security tooling and coach engineers on secure LLM, LLM Gateway, MCP, RAG, and agent patterns
- Maintain SDLC and vulnerability management controls for SOC 2 readiness
- Participate in the security on-call rotation
- Establish scalable security testing, software supply-chain security, AI security guardrails, vulnerability-intake processes, and product-security metrics
Requirements:
- 6+ years in software or security engineering, including 3+ years in application or product security
- Production coding experience in Python, TypeScript, Go, or Java
- Hands-on GitHub Actions at scale, including reusable workflows, OIDC, secrets, and self-hosted runners
- Knowledge of pipeline attacks and defenses, including poisoned pipeline execution, dependency confusion, compromised actions, pinning, SBOMs, artifact signing, and SLSA
- Experience running SAST and SCA programs across many repositories and writing custom rules
- Hands-on penetration testing of web applications and APIs
- Experience with authenticated DAST
- Fluency in OWASP Top 10 and API Security Top 10
- Hands-on experience securing LLM applications or agents against prompt injection, data leakage, insecure output handling, and excessive agency
- Daily use of AI coding assistants
- Structured threat modeling and secure design review using STRIDE and/or MAESTRO
- Hands-on cloud security experience with AWS, GCP, or Azure, including identity and access, network controls, containers, and infrastructure as code
- Experience embedding with engineering teams and shipping fixes in their codebases
- Ability to influence without authority, explain risk in business terms, write clear documentation, and own outcomes end to end
Benefits:
- Performance-based bonuses may be available
- Equity awards may be available
- Comprehensive health, dental, and vision insurance
- Flexible time off and holidays
- 401(k) with company match
- Disability insurance and life insurance
- Leaves of absence in accordance with applicable laws, regulations, and company policy
- Flexible work model, with roles that may be performed from anywhere in the country
- AI-integrated daily work environment
Similar Jobs
Senior Digital Security Specialist – Offensive and Defensive Security
Especialista sênior em segurança digital na Evertec, empresa de tecnologia financeira. Executando testes de intrusão e orientando remediações em aplicações, infraestrutura e nuvem.
Senior Instructor, Training – Cloud Security
Cloud security instructor delivering hands-on CNAPP and Falcon Cloud Security training. Developing courses, certification exams, and labs for CrowdStrike customers.
Cloud Azure Security Engineer
Cloud Azure Security Engineer securing Microsoft Azure environments for Monks, a global AI-powered transformation consultancy. Managing Entra ID, compliance controls, vulnerabilities, and cloud security automation.
Staff Product Security Engineer
Staff Product Security Engineer embedding with ServiceTitan engineering portfolios to secure SaaS applications, cloud infrastructure, and AI-enabled features. Driving threat modeling, remediation, paved-road adoption, and portfolio risk reduction.
Senior Information Security Coordinator
Coordenador sênior de segurança da informação no Bernoulli Educação, grupo educacional brasileiro. Gestão de riscos, LGPD, incidentes, vulnerabilidades e equipes.
Incident Response Product Security Engineer II
Incident response engineer securing Esri’s ArcGIS geographic-information software. Investigating vulnerabilities, facilitating red-team exercises, and advancing product security practices.
Security Assessor
Security Assessor evaluating federal information systems against NIST RMF and FedRAMP requirements. Conducting control assessments, risk analysis, ATO support, and compliance documentation remotely.
Staff Engineer, Security
Staff Security Engineer strengthening NextGen Healthcare’s cloud security posture. Automating threat detection, vulnerability mitigation, and AI-enabled security operations across cloud systems.
Security Architect – Zero Trust, Application Access
Security Architect designing Zscaler Zero Trust access for internal business applications. Assessing application exposure, establishing security standards, and guiding cross-functional implementation.
Security Engineer
Security Engineer protecting Allium’s canonical onchain finance data infrastructure, cloud systems, and AI agents. Building detection, response, access, and compliance controls.
Manager, Cloud Security Engineering
Cloud security engineering manager leading AWS, Azure, and GCP security teams for Workstreet’s compliance-focused client engagements. Building hardened infrastructure, automation, and audit-ready controls.
Security Engineer
Security Engineer owning vulnerability management, SIEM, and incident investigations. Securing cloud-native AWS environments for Arionkoder’s AI consulting clients.
IT Systems and Security Specialist I
IT systems and security specialist supporting Aspire Living & Learning’s service operations remotely. Maintaining IT systems and security while traveling periodically across the service area.
Associate, Cybersecurity – Data Privacy Incident Response
Associate attorney advising clients through cybersecurity incidents, data breaches, and breach notification requirements. Supporting Constangy's national Cybersecurity & Data Privacy practice.
Associate, Cybersecurity – Data Privacy Litigation
Associate attorney defending privacy, cybersecurity, and complex commercial litigation for Constangy, Brooks, Smith & Prophete, LLP. Conducting research, drafting litigation documents, and supporting cases through trial preparation.
Associate Security Researcher
Associate Security Researcher supporting Cobalt’s penetration-testing research through systems administration, threat simulation, vulnerability triage, and technical report quality control.
Cyber Security Engineer
Cyber Security Engineer leading incident response, threat hunting, and forensics for NVIDIA’s corporate, cloud, and product environments. Building automated defenses against advanced threats.
Senior Security Research Architect, Confidential Computing
Senior Security Research Architect designing Trusted Execution Environment architectures for NVIDIA NICs and DPUs. Driving confidential-computing security across hardware, software, research, and product teams.
IT and Security Manager
IT and Security Manager securing Microsoft 365, Azure, vendors, and cybersecurity operations for Furnished Quarters’ furnished apartment business. Managing infrastructure, incident response, access, compliance, and technology partnerships.
Senior Security Engineer
Senior Security Engineer protecting Cisco’s network-device portfolio through threat modeling, code review, and reproducible security testing. Improving embedded and IoT security across hardware, firmware, and device lifecycles.