Application & Product Security Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Application & Product Security Engineer based in United States.

• Own and continuously mature the secure software development lifecycle, including security requirements, threat modeling, design reviews, and security controls for high-risk product changes, APIs, and integrations.
• Run and optimize SAST, SCA, secrets detection, container, and infrastructure-as-code scanning across development and CI/CD environments.
• Build reusable secure patterns, reference implementations, and policy-as-code controls.
• Lead developer security enablement through Security Champions programs, training campaigns, remediation guidance, office hours, and self-service security capabilities.
• Manage application and product vulnerabilities through risk-based triage, remediation SLAs, escalations, exceptions, exploit reproduction, patch validation, and release verification.
• Own the penetration testing program, including scoping third-party engagements, performing targeted testing, coordinating remediation, and validating findings through retesting.
• Manage the Vulnerability Disclosure Program and coordinate communications with external researchers, customers, and other stakeholders.
• Coordinate the CVE lifecycle for products and support product-security incident response activities.
• Own application and product-security controls within the NIST CSF 2.0 program.
• Establish and maintain the security posture of products across SaaS and customer-hosted environments.
• Own the Product Security Roadmap in partnership with Product Management, Technology leadership, and Architecture.
• Serve as the technical owner for customer-facing product security.
• Lead threat modeling and security reviews for LLM-enabled product features, AI agents, and AI-assisted development workflows.
• Develop security controls and secure patterns addressing prompt injection, sensitive data exposure, insecure output handling, excessive agency, insecure tool integrations, and AI supply-chain risks.
• Apply and operationalize relevant AI security frameworks and guidance, including the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework.

• 6+ years of experience in application security, product security, or secure software engineering.
• Strong software development capabilities in an object-oriented programming language, with Java experience preferred; ability to work across languages such as TypeScript, Python, or Go.
• Deep understanding of modern application attack surfaces, including authentication, authorization, API security, business-logic vulnerabilities, and contemporary service architectures.
• Hands-on experience integrating and tuning SAST, SCA, and secrets scanning within GitHub and CI/CD pipelines.
• Demonstrated ability to reproduce security exploits against running applications, validate patches, and translate technical findings into actionable guidance.
• Experience coordinating vulnerability disclosure with external security researchers and customers, including managing disclosure timelines and driving CVEs through publication.
• Experience securing shipped software with an established customer base.
• Practical experience with threat modeling, architecture and design reviews, manual security testing, and direct collaboration with developers throughout remediation.
• Strong communication skills and the ability to translate complex technical risks into clear engineering guidance.
• Confidence making and defending release-gating security decisions.
• Experience with AI application security, AI agents, or AI-assisted development tools is preferred.