Product Security Architect (Remote US)

Role overview Provide hands-on product security guidance for a Kubernetes-based object and file storage platform. You’ll assess architecture and threats, investigate vulnerabilities, validate fixes, and work directly with engineering teams to turn security findings into practical design and implementation improvements. This is a remote position for candidates authorized to work in the United States without current or future sponsorship.

Responsibilities - Lead threat modeling and security architecture reviews across infrastructure, storage services, APIs, management interfaces, and data protection. - Assess CVEs for product applicability, reachability, exploitability, and potential customer impact. - Conduct focused security testing, reproduce vulnerabilities, develop proof-of-concept tests, and independently verify remediation. - Review source code, Kubernetes manifests, Helm charts, scripts, configurations, software bills of materials, and third-party dependencies. - Work with engineering to identify root causes and attack paths and recommend clear security controls and design changes. - Support security advisories, VEX and SBOM/SCA analysis, customer security questions, and relevant compliance requirements.

Requirements - At least five years of hands-on experience in product, application, cloud, container, infrastructure security, or penetration testing. - Strong experience with Kubernetes-based, containerized, storage, or distributed platforms. - Deep understanding of Kubernetes, Linux, network and API security, authentication and authorization, secrets, TLS/mTLS, encryption, and key management. - Experience assessing object or file storage, including S3-compatible interfaces, access controls, multitenancy, and data protection boundaries. - Ability to investigate vulnerabilities, review code and configurations, perform penetration testing, and confirm fixes; relevant tools include kubectl, Trivy, Grype, Burp Suite, OpenSSL, and Nmap. - Strong written and verbal communication skills for explaining risk and remediation to technical and business stakeholders.

Nice to have Security certifications such as CKS, OSCP, GPEN, or CISSP are preferred; demonstrated practical security experience is valued.

Benefits and work setup Remote within the United States. The listed base salary range is $130,000–$160,000, with expected on-target earnings of $145,000–$175,000. Eligibility for variable compensation depends on program terms.