Product Security Specialist II — Remote & AI Governance

Safe Software; Surrey; Hybrid; CAD 90,000 - 120,000; Full time

Job summary

Safe Software is seeking a Product Security Specialist II to join our Product Security team within Information Security. The role focuses on defining security policies, supporting AI governance, and engaging with customers and partners to address security needs.

You will own a broad set of responsibilities across policy, supply chain security, vulnerability disclosure, and non-engineering app security in a remote-friendly, collaborative environment.

Qualifications

• 3+ years of experience in product security, application security, or a closely related cybersecurity role.
• Strong technical background in cybersecurity, secure development practices, and security tooling.
• Proficiency in Python for automation.
• Ability to communicate security concepts clearly to diverse stakeholders.

Responsibilities

• Stakeholder enablement and communication with developers, product management, customers, and partners.
• Contribute to security policies and standards, maintain risk register, and support policy compliance monitoring.
• Conduct security reviews of third-party libraries and vendor components.
• Support AI governance program for developers and monitor AI security risks.
• Manage vulnerability disclosure processes, CVE registration, and postmortems.
• Provide security coverage for non-engineering apps and services, including sites and APIs.

Skills

Product security

OWASP Top 10

SAST tooling

DAST tooling

Python

Communication

Agentic AI

Education

Bachelor's degree in CS / Cybersecurity or related field

Tools

SAST tooling

DAST tooling

SCA tooling

APIs security tools

Job description

Safe Software is seeking a Product Security Specialist II to join our Product Security team within Information Security. The role focuses on defining security policies, supporting AI governance, and engaging with customers and partners to address security needs.

You will own a broad set of responsibilities across policy, supply chain security, vulnerability disclosure, and non-engineering app security in a remote-friendly, collaborative environment.