Principal or Staff Product Security Engineer

Join our team as a Principal or Staff Product Security Engineer, where you'll be responsible for the day-to-day execution of our product security program across our cloud backend, mobile apps, and Android platform. You'll work closely with the Head of Security and be the go-to person for hands-on security expertise. Your responsibilities will include managing the vulnerability management pipeline, running our bug bounty program, leading security design reviews, and providing metrics and data on findings and remediation.

Responsibilities

• Own the day-to-day execution of the product security program, including vulnerability management, bug bounty program, and security scanning.
• Work closely with engineering teams to provide hands-on security expertise, lead security design reviews, and drive remediation of vulnerabilities.
• Manage third-party penetration testing engagements, lead security design reviews, and provide metrics and data on findings to support compliance.
• Hands-on experience running or triaging a bug bounty program
• Clear written communication and the ability to explain risk to both engineers and non-technical stakeholders
• Mobile application security experience (OWASP MASVS), ideally including shipping fixes in a mobile codebase

Requirements

• 6+ years in application or product security, with a software engineering background. You can ship production code, not just review it
• Deep experience securing backend services and APIs, including OAuth 2.0/OIDC, PKCE, MFA, session management, and token handling
• Experience building and maintaining security tooling and automation (static analysis, CI integrations, custom scanners), and comfort working with LLM-based systems
• A track record of getting engineering teams to prioritize and fix security issues through influence and good judgment, not escalation
• Android platform or app security experience
• Familiarity with the EU Cyber Resilience Act or UK PSTI

Preferred

• Experience assessing AI/LLM features for risks like prompt injection and data leakage
• Exposure to embedded, IoT, or firmware security
• Familiarity with children's privacy requirements (e.g. COPPA) or other sensitive consumer data
• Incident response experience

Pay

USD 200,000 - 250,000

Benefits

• This is a remote position with a range of benefits including health insurance, a wellness stipend, and a collaborative work culture.