Staff Product Security Engineer

Aiven; Helsinki; On-site; EUR 90,000 - 150,000; Full time

Benefits offered by this job

Equity plan

Hybrid work policy

Equipment for success

Professional Development Budget

Wellbeing program

Global Time Off Commitment

Country-specific benefits

Job summary

Aiven is seeking a Staff Product Security Engineer to join our Product Security team. You will identify, report, and help remediate vulnerabilities, manage our bug bounty program, and provide security insights for new products.

Collaborate with IAM and Security Operations to secure our products and infrastructure. You’ll perform vulnerability triage, security testing, audit support, and IAM automation tasks, while contributing to PCI DSS, ISO 27001, and SOC 2 compliance initiatives across a

Qualifications

• Bachelor's or Master's in CS/Engineering/Info Security or equivalent training.
• 5+ years in information security or related field.
• Experience in software development, SRE, architecture, risk management, and PM assets.
• Knowledge of security, distributed systems and microservices.
• Senior certifications in hyperscaler clouds and security testing beneficial.
• Experience in risk and vulnerability management in multi-cloud environments.
• Experience with modern tech such as public cloud and networking.
• Fluency in English, verbal and written.

Responsibilities

• Triaging and analyzing vulnerability results; document false positives.
• Review internal network vulnerability scans with admins and prioritize remediations.
• Conduct security testing of products using tools and manual methods; report findings.
• Evaluate issues reported by staff, customers, and third parties for reproducibility.
• Determine if engineering fixes address vulnerabilities and perform gap analysis.
• Support PCI DSS, ISO 27001, SOC 2 compliance with reports and validation.
• Identify gaps in scanner coverage and suggest improvements to configurations.
• Assist in 3rd-party audits and penetration tests.
• Assist IAM automation and AI security assessments.

Skills

5+ years information security

Software development experience

Fluency in English

Risk management

Education

Bachelor's or Master's in CS/Engineering/Info Security/IT

Tools

Vulnerability scanners

Security testing tools

Audit tooling

Job description

We’re a global team of over 400 people, working together to push the boundaries of open-source technology and multi-cloud solutions. Our vision is to help developers, builders, and creators bring their ideas to life with speed and simplicity, by providing a cloud data platform that makes open-source databases, search, streaming, and application infrastructure easily accessible to everyone.

The Role:

We are looking for a Staff Product Security Engineer to join our Product Security team. The role of Aiven’s product security is to identify, report, and assist with the remediation of security vulnerabilities, to manage our bug bounty program, and to provide technical security insights into new products that the Aiven engineering organization is developing. The Staff Product Security Engineer will also work closely with the Identity and Access Management team and Security Operations to ensure the security of our products and infrastructure.

What You’ll Do:

• Vulnerability Management: Triaging and analyzing results from our vulnerability scanners. This includes identifying and documenting false positives to minimize unnecessary remediation efforts. You will work with documentation and other team members to identify risk-based decisions and write responses to audit questions.
• Network Security Scanning: Participate in the regular review of internal network vulnerability scans. Collaborate with network and system administrators to prioritize and remediate identified vulnerabilities, escalating critical issues as needed.
• Security Assessment: Independently conduct security testing of our products using a variety of methodologies, including tool-based assessment and manual testing. Report and document findings for internal users. Apply and state industry-standard methodologies for testing to meet audit requirements.
• Issue triage: You will evaluate issues reported by internal staff, customers, and third parties as to reproducibility, and track information on true positive security vulnerabilities.
• Remediation validation: You will determine whether engineering changes have fixed security vulnerabilities, and conduct a gap analysis where required.
• Compliance Support: Contribute to compliance efforts (e.g., PCI DSS, ISO 27001, SOC 2) by assisting in the preparation of reports and documentation related to vulnerability scanning activities. This may involve documenting false positives, validating compensating controls, and ensuring accurate reporting.
• Scanner Optimization: Contribute to the ongoing improvement of our vulnerability scanning program by identifying and reporting any gaps in scanner coverage. This includes verifying that all intended systems and applications are being scanned and suggesting improvements to scanning configurations.
• Audit: Assist in execution of 3rd-party audits and penetration tests
• IAM Automation: Assist with the automation of identity and access management procedures and reporting
• AI Security: Assess the security of artificial intelligence algorithms in Aiven’s products

What We’re Looking For:

We are looking for talented self-starters who want to learn about security and grow into roles such as Software Engineer in Security and Information Security Analyst. We will consider candidates with less security-specific experience but with the desire to learn!
Examples of attributes for success in this role include:

• A bachelor's or master’s degree in computer science, engineering, information security, information technology, or equivalent training
• 5+ years of experience in information security or a related field
• Experience in software development, site reliability engineering, software or IT architecture, business analysis, risk management, and project management are assets
• Detailed knowledge of security, distributed systems, and microservices architecture
• Senior certifications in hyperscaler clouds and in security testing; certifications in risk management are beneficial
• Detailed understanding of risk management and vulnerability management practices, specifically in a multi-cloud environment
• Relevant experience from modern technologies such as public cloud and networking
• Experience with programming and software development
• Fluency in English, verbal and written

Amazing! What’s next:

If you think Aiven is the place for you and that our Values align with yours, send us your resume and we’ll get in touch!

Global Benefits:

Our global benefits are designed to help you thrive and grow, personally and professionally:

• Participate in Aiven’s equity plan.
• Balance work and life with our hybrid work policy.
• Choose the equipment you need to set yourself up for success.
• Use your Professional Development Plan budget for learning opportunities.
• Receive holistic wellbeing support through our global Employee Assistance Program.
• Inquire about our Global Time Off Commitment (Parental and Sick Leave, as well as Personal Time)
• Enjoy country-specific benefits for our global cast.

How to Recognize and Avoid Employment Scams:

There has been a rise in fake job postings used by scammers to get personal information. At Aiven, all of our emails relating to recruitment come from an @aiven.io, @greenhouse.io or @eu.greenhouse.io domain and all of our interviews are conducted by video call or in person. Our interviews will never occur via text or chat. If you’re unsure of the legitimacy of a job opportunity/offer pertaining to Aiven, please don’t hesitate to reach out to us at [e-mail].

Equal Opportunities:

Aiven provides equal employment opportunities to all qualified employees and applicants for employment without regard to age, gender identity, national or ethnic origin, religion, sexual orientation, physical and mental ability, marital and family status or without regard to any other similar personal attributes. Aiven complies with applicable local laws governing non-discrimination in employment in every location in which the company operates. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, transfer, leaves of absence, compensation, training and any other terms and conditions related to employment.

At Aiven we are committed to providing reasonable accommodations for qualified individuals with disabilities or special needs in our working environment and job application procedures. We make all reasonable accommodations for persons with disabilities or who otherwise need support to thrive in the workplace. We are committed to continuously improving workplace accessibility. There is an option to request a discussion in the application process but if you have any questions before applying please write to us at [e-mail].