Responsibilities

  • Partner with engineering teams to identify and address security risks across mobile applications, web products, APIs, and backend services.
  • Lead security reviews and threat modeling for new products and major architectural changes, focusing on authorization boundaries, sensitive data, transaction integrity, key material, and third-party integrations.
  • Embed security controls throughout the software development lifecycle, from design and implementation to testing, release, and production operation.
  • Conduct AI-assisted security code reviews and targeted testing of high-risk features; build repeatable vulnerability discovery approaches.
  • Improve security tooling and automated workflows to give engineers actionable feedback.
  • Harden CI/CD, build, and release systems against supply chain threats, dependency risks, secrets exposure, and compromised workflows.
  • Triage security findings and drive verified remediation; support incident investigations and turn lessons into lasting improvements.
  • Establish product security patterns and lead cross-functional initiatives that influence engineering architecture.

Requirements

  • 5+ years of experience in product security, application security, security engineering, or software engineering, including senior- or staff-level experience.
  • Strong understanding of web, mobile, API, and distributed-system security, including authentication, authorization, session management, cryptography, and common vulnerability classes.
  • Hands-on experience building or applying AI-assisted security tooling, combining automated analysis, source-code review, and manual validation.
  • Production code review experience in one or more of TypeScript, JavaScript, Rust, Python, and Go.
  • Experience securing software supply chains and CI/CD systems, threat modeling complex products, and translating risks into engineering requirements.
  • Strong judgment in assessing exploitability and business impact, effective collaboration with engineering and product teams, and clear communication with technical and non-technical stakeholders.