Product Security Architect: Threat Modeling & CI/CD Gatekeeper

Nominal; New York, Washington, Los Angeles, Austin (NY, District of Columbia, CA, TX); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

100% covered health, dental, andVision

Unlimited paid vacation

12 weeks parental leave

Fertility and family planning ($15,000

Lunch provided daily

Wellness stipend ($100/month)

$500/year hardware sensor stipend

Learning and development stipend

401(k)

Employee-friendly equity terms

In-office 5 days per week

Job summary

Nominal is building the Hardware Intelligence Platform to empower hardware engineers with visibility into complex physical systems. We seek a Product Security Engineer to design secure by default pipelines, implement SAST/SCA/secrets scanning, and own DAST programs, CVE remediation, and security standards across distributed services.

You’ll lead cross‑team work, guide engineers on secure SDLC practices, and shape security requirements for customer‑facing features.

Qualifications

• Strong software engineering background with production services in at least one modern language.
• Hands-on threat modeling and security design reviews for distributed systems.
• Experience operating SAST, SCA, secrets scanning, and DAST in CI/CD.
• Experience running vulnerability management including triage and remediation SLAs.
• Experience scoping penetration tests with testers and engineering teams to close findings.
• Record of writing security standards or requirements that engineering teams adopt in practice.
• Ability to lead cross-team work and make risk-based decisions amid ambiguity.

Responsibilities

• Lead threat modeling and security design reviews for new services and features, so design flaws are found and fixed before code ships.
• Architect and own SAST, SCA, and secrets-scanning gates in our CI/CD pipelines, tuned so engineers trust the results and act on them.
• Own our DAST program, from tool selection and coverage through triage of findings with the teams that own the affected services.
• Run product vulnerability management, including the CVE remediation workflow and SLAs, and drive fixes across multiple engineering teams.
• Define secure SDLC standards and enable developers with guidance, tooling, and examples they can apply without security in the loop.
• Scope and coordinate penetration tests, then drive remediation of findings to closure with the responsible teams.
• Define security requirements for customer-facing features and integrations, and mentor engineers on applying them.

Skills

Software engineering

Threat modeling

CI/CD security

Vulnerability management

Penetration testing

Security standards

Cross-team leadership

Job description

Nominal is building the Hardware Intelligence Platform to empower hardware engineers with visibility into complex physical systems. We seek a Product Security Engineer to design secure by default pipelines, implement SAST/SCA/secrets scanning, and own DAST programs, CVE remediation, and security standards across distributed services.

You’ll lead cross‑team work, guide engineers on secure SDLC practices, and shape security requirements for customer‑facing features.