Staff Product Security Engineer
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Staff Product Security Engineer leading penetration testing across Guidewire’s cloud insurance platform. Securing web applications, APIs, SaaS architectures, and AI-powered product features.
Responsibilities:
- Lead penetration testing across Guidewire’s products
- Plan and perform penetration tests of web applications, APIs, cloud services, integrations, multi-tenant SaaS environments, and AI/ML-powered product features
- Identify, validate, reproduce, risk-rate, and retest vulnerabilities; provide actionable remediation guidance
- Develop penetration-testing tooling, scripts, automation, and evaluate AI-assisted and autonomous testing tools
- Own the pen testing schedule across the product release lifecycle and ensure products are tested before key release milestones
- Define testing scope, rules of engagement, environments, and access for vendor engagements
- Align product teams, implementation partners, and vendors on testing responsibilities
- Manage vendor relationships, statements of work, kickoffs, status tracking, report quality reviews, and escalations
- Manage the penetration-testing budget, vendor costs, forecasting, and utilization
- Review vendor reports, remove false positives, and consolidate findings into vulnerability management
- Evaluate vendor performance and recommend methodology or vendor changes
- Ensure testing meets SOC 2, ISO 27001, PCI DSS, and customer contractual requirements
- Maintain pen test evidence, attestation letters, and executive summaries for auditors and customers
- Track remediation against SLAs and report status, risk, and program metrics to product, engineering, and security leadership
- Respond to customer security questions about testing practices and results
- Support PSIRT activities including vulnerability triage, root cause analysis, incident coordination, security releases, code and design reviews, and validation of SAST, DAST, SCA, and container scanning findings
Requirements:
- Bachelor's or master's degree in computer science, or equivalent experience
- 7+ years of application or product security experience, including at least 5 years of hands-on penetration testing of web applications, APIs, and cloud-hosted services
- Proven experience managing third-party pen testing vendors, including scoping, scheduling and report review
- Hands-on experience testing applications hosted on AWS, including IAM and multi-tenant architectures
- Working knowledge of compliance requirements for pen testing, such as SOC 2, ISO 27001, or PCI DSS
- Solid understanding of the OWASP Top 10, OWASP API Security Top 10, OWASP Top 10 for LLM Applications, and common product vulnerability classes
- Hands-on experience with pen testing tools such as Burp Suite, along with SAST, DAST and vulnerability scanning tools
- Experience risk-rating vulnerabilities with CVSS
- Scripting skills (Python, Shell, or similar) to build testing tools and automation
- Strong written and verbal communication skills, including the ability to write clear pen test reports for engineers, executives, and customers
- Proven ability to build relationships and influence people at all levels, as well as vendors and external partners
- Industry certifications such as OSCP, OSWE, GPEN, GWAPT, CSSLP, or CISSP are nice to have
- Experience testing AI/LLM applications in production is nice to have
- Bug bounty participation or published security research is nice to have
- Knowledge of the security research community is nice to have
- Development experience in Java, C++ or Python is nice to have
- Experience in a PSIRT or product incident response role is nice to have
- Experience with insurance, financial services, or other regulated SaaS products is nice to have
Benefits:
- Equal opportunity and affirmative action employer
- Disability-inclusive employer
- Individualized accommodations and support throughout the hiring process
Similar Jobs
Head of Cyber Security
Head of Cyber Security leading cybersecurity strategy and governance for ABB’s global Process Control Platform. Protecting automation products through risk management, compliance, Linux and Kubernetes expertise.
Information Systems Security Officer
Information Systems Security Officer leading RMF authorization and cybersecurity compliance for federal on-premises and AWS systems. Managing eMASS, STIGs, vulnerability remediation, and continuous monitoring.
Staff Security Engineer – AppSec
Staff AppSec Engineer definindo segurança para produtos de pagamentos da Stone, incluindo aplicações com LLMs e IA generativa. Proteção de APIs, cloud, CI/CD e sistemas de produção.
Security Engineer II
Security Engineer securing Iovance’s cloud, identity, endpoint, email, and DevSecOps platforms. Supporting audit-ready security operations for a company developing TIL cancer therapies.
Application Security Developer III
Application security developer securing CareSource web, mobile, and service applications. Testing vulnerabilities, reviewing code, and automating security tools and processes.
Security Engineer – Agentic AI
Security Engineer securing agent gateways, tools, models, and data flows. Building production controls for BRAHMA AI’s enterprise media technology platform.
Senior Cybersecurity Specialist
Abbott Senior Cybersecurity Specialist conducting threat modeling and risk assessments. Securing healthcare product architectures and supporting regulatory cybersecurity activities.
Oracle Cloud Security Expert
Oracle Cloud Security Expert designing and implementing Oracle SaaS security controls for Highstreet. Managing roles, audits, access governance, patch testing, and compliance.
Security Specialist
Security Specialist conducting NIST-based vendor risk assessments for North Carolina government IT. Delivering inventories, risk registries, and assessment reports.
Senior Application Security Researcher
Senior Application Security Researcher advancing AI-driven application vulnerability detection. Building agentic penetration-testing capabilities with engineers, researchers, and AI/data scientists.
Senior Information Security Engineer
Senior Information Security Engineer building secure modules for Walrus’s B2B payment verification platform. Designing authentication, payments, and reputation capabilities with the core engineering team.
Security Engineer
Security Engineer securing Noxtua’s sovereign Legal AI cloud infrastructure, GPU systems, and AI workloads. Building DevSecOps controls and supporting ISO 27001, BSI C5, and TISAX compliance.
Cybersecurity Consultant
Part-time remote cybersecurity consultant securing Scopic’s software delivery, cloud environments and compliance. Building Secure SDLC practices and mentoring the internal Security Lead.
Senior Security Engineer
Senior Security Engineer protecting Technosylva’s cloud-hosted platform through cloud, AI, vulnerability, and incident security. Automating controls and advising infrastructure, platform, and IT teams.
Senior Strategic Security Advisor
Senior cybersecurity advisor guiding regulated organizations through CMMC, risk, and compliance. CIT delivers managed IT, cybersecurity, cloud, and custom technology solutions.
Senior Security Engineer – Identity & Endpoint
Senior Security Engineer designing identity, endpoint, and device-trust controls for Fortellar’s enterprise IT consulting clients. Leading high-risk Microsoft security remediation and change programs.
Offensive Cybersecurity Engineer – RL Environments for AI Evaluation
Offensive cybersecurity engineers building and hardening reinforcement-learning environments. Evaluating frontier AI models for Terac, a platform connecting vetted experts with AI researchers and labs.
Senior System & Information Security Administrator
Senior administrator owning global servers, networks, security, backups, and end-user support. Coordinating external IT providers for a Bulgaria-based company.
Cybersecurity & Information Assurance Specialist – Federal Health IT
Cybersecurity specialist maintaining DoD information assurance records and security compliance. Supporting federal healthcare technology readiness through STIG, ACAS, eMASS, and access reviews.
Information Security System Specialist – ATO Lead
ATO Lead preparing VA records application authority-to-operate packages under the Risk Management Framework. Supporting security controls, continuous monitoring, remediation, and Zero Trust governance remotely.