Staff Product Security Engineer

Role overview Lead penetration testing for a portfolio of cloud hosted products, including web applications, APIs, integrations, and AI-enabled features. You’ll set the testing approach across product releases, combine internal work with specialist vendor engagements, and guide teams from validated findings through verified fixes. The role may also contribute to vulnerability triage and incident coordination.

Responsibilities - Plan and perform penetration tests, including assessments of tenant isolation and authorization boundaries in multi-tenant services. - Test AI and LLM features for risks such as prompt injection, data leakage, insecure retrieval, and misuse. - Reproduce, assess, and prioritize vulnerabilities; provide practical remediation guidance and retest fixes. - Build testing scripts and automation, and assess AI-assisted testing tools. - Manage vendor engagements, including schedules, scope, access, deliverables, quality reviews, and budgets. - Track testing coverage, remediation deadlines, and program metrics; prepare evidence and summaries for auditors, customers, and leadership. - When needed, support vulnerability response, researcher communications, security releases, and review of automated security scan findings.

Requirements - Bachelor’s or master’s degree in computer science, or equivalent experience. - 7+ years in application or product security, including at least 5 years of hands-on penetration testing of web applications, APIs, and cloud services. - Experience managing third-party penetration testing providers. - Ability to assess vulnerabilities using CVSS or similar risk-rating methods. - Scripting ability in Python, Shell, or a comparable language. - Strong communication skills, including writing clear technical findings and influencing engineering teams and external partners.

Nice to have - Certifications such as OSCP, OSWE, GPEN, GWAPT, CSSLP, or CISSP. - Experience testing AI or LLM applications in production, security research, or bug bounty programs. - Development experience in Java, C++, or Python; PSIRT experience; or work with regulated SaaS products.