Staff Product Security Engineer

Role overview Set the technical direction for product security across a software platform, and turn security findings into practical fixes and safer engineering workflows. The role combines hands-on application security with threat modeling, automation, and close partnership with engineering and product teams; it also helps shape customer-facing product decisions.

Responsibilities - Establish and execute security strategy across software supply chains, first-party code, runtime monitoring, and AI agent protections. - Investigate and prioritize vulnerabilities, drive remediation, and use internal security tooling to validate findings and fixes. - Build security automation and engineering paths that help teams catch and prevent insecure code before it is merged. - Conduct threat models and design reviews, and advise engineering and product teams on implementation choices and roadmap priorities. - Evaluate how LLMs and agents can support security work, including testing tools and measuring their limitations. - Share useful practices and product feedback with customers and the broader security community.

Requirements - More than ten years of application or product security experience, including technical leadership at staff or principal level. - A record of building and measuring security tools or automation used across an engineering organization. - Experience influencing product or platform roadmaps and getting security improvements adopted by other teams or customers. - Hands-on experience applying LLMs or agents to security problems, such as evaluating ways to find, validate, fix, or prevent vulnerabilities. - Deep skills in threat modeling and secure architecture. - Able to set direction and influence senior engineering, product, and customer stakeholders without relying on formal authority. - Comfortable investigating root causes, driving fixes, and setting priorities in an ambiguous environment.

Nice to have Experience securing large build systems or CI/CD environments, especially Bazel monorepos; security research in vulnerability analysis, program analysis, or static analysis; or public work such as talks, publications, and open-source projects.