Staff Product Security Engineer

Role overview

Lead hands-on product security work across software delivery pipelines and cloud-native services. The role embeds security into engineering workflows by building preventive controls, assessing product risks, and guiding teams in hardening Kubernetes workloads and the cloud infrastructure they rely on.

Responsibilities - Design and maintain CI/CD pipelines with security checks that identify problems before release. - Automate the assessment of product risk and implement supply-chain safeguards, including signed artifacts, software bills of materials, and provenance attestations. - Lead architecture reviews and threat modeling for Kubernetes workloads on major cloud platforms. - Reduce attack surfaces by hardening container images, cluster configurations, and cloud identity and access controls. - Establish and promote security baselines for pod security, network policies, workload identity, and secrets management. - Identify emerging customer security needs and develop practical solutions.

Requirements - Eight or more years in software engineering, security engineering, or a combined role with substantial hands-on security work. - Strong Go or Python skills, including writing, reviewing, and debugging production code. - Deep production Kubernetes experience, including cluster hardening, RBAC, network policies, and admission controllers. - Practical GCP and/or AWS security experience, including IAM, workload identity, secrets management, and relevant security services. - Demonstrated experience securing CI/CD systems such as GitHub Actions, Cloud Build, or Tekton. - Knowledge of container scanning, minimal base images, and runtime security. - Experience with software supply-chain security tools and frameworks such as Sigstore, SLSA, and SBOM generation. - Understanding of OWASP, NIST, and cloud security frameworks, with the ability to apply them pragmatically.

Nice to have

Experience with hardened container image ecosystems, policy-as-code tools such as OPA or Kyverno, open-source security contributions, or security research and offensive testing.

Benefits and work setup

Remote-first work with team meetups, twice-yearly destination gatherings, and a monthly stipend for coworking, phone, and internet costs. Benefits also include stock options, fully covered health, vision, and dental premiums for employees and dependents, flexible time off, and paid parental leave of 18 weeks for birthing parents and 12 weeks for non-birthing parents.