Senior Product Security Engineer

Join our team as a Senior Product Security Engineer, where you'll build and operate the modern security tooling pipeline that underpins our Product Security team. You'll establish and maintain the SDLC security infrastructure, design and operate product security reviews, and ensure security tooling integrates cleanly into engineering workflows. You'll also support product incident response and work closely with various teams across the organization.

Cloud security experience across AWS, Azure, or Kubernetes environments

Responsibilities

• Establish and maintain the SDLC security infrastructure using various security tools, ensuring fast and reliable security feedback on every commit, PR, and release.
• Design and operate automated product security review workflows with human-in-the-loop checkpoints, ensuring coverage scales with the engineering organization without becoming a bottleneck.
• Partner closely with Security Testers, Architects, the TPM, and engineering teams across the product portfolio to ensure security tooling integrates cleanly into engineering workflows.
• 4+ years in Application Security, Product Security, DevSecOps, or Security Engineering with hands-on experience building and operating security tooling in CI/CD pipelines
• Automation-first mindset. You default to building repeatable, scalable workflows and reach for manual processes only when automation genuinely falls short
• Experience with GitHub Advanced Security at scale: CodeQL custom queries, secret scanning custom patterns, and organization-wide rollout

Requirements

• Hands-on experience with AI-powered security tooling such as Claude Code Security, Codex Security, or similar LLM-based code analysis platforms
• You understand common vulnerability classes well enough to tune tooling, triage findings, and have credible conversations with engineers about severity and remediation
• Experience implementing and tuning SAST, DAST, SCA, and secret scanning tools in GitHub-integrated environments (GitHub Advanced Security, CodeQL, Dependabot, or equivalent)
• Strong understanding of CI/CD pipeline architecture and how security controls integrate without disrupting developer velocity
• Experience building automation workflows: scripting, pipeline configuration, policy-as-code, webhook integrations, and workflow orchestration
• Strong collaboration skills. You'll work across Security Testers, Architects, TPM, and engineering teams daily and need to communicate effectively with all of them
• Experience supporting product incident response or security incident investigation
• Background operating Wiz CLI or similar cloud/container security scanning integrated into CI/CD
• Familiarity with policy-as-code frameworks (OPA/Rego, Kyverno, or similar)
• Experience building developer enablement programs, security documentation, or self-service security tooling

Preferred

• Familiarity with container security scanning tools (Wiz CLI, Trivy, Snyk Container, or equivalent) and cloud security fundamentals (AWS preferred)
• Background in securing endpoint technologies, identity systems, or enterprise security platforms