Product Security Engineer

Bright Mind Solutions LLC; Sunnyvale (CA); On-site; USD 140,000 - 190,000; Part time

Job summary

Bright Mind Solutions LLC in Sunnyvale, CA is seeking a Product Security Engineer to embed security into the product design and development lifecycle. You will work with cross‑functional engineering teams to secure the application platform from concept through release.

The role emphasizes threat modeling, SAST/DAST tooling, cloud security across AWS/GCP/Azure, and collaboration with incident response to drive remediation and secure CI/CD pipelines.

Qualifications

• 5+ years as Security Engineer, Application Security Engineer, or Product Security Engineer in a complex software org.
• Proficiency in Python and TypeScript; familiarity with security tooling and protocols.
• Implemented AI to accelerate security program identification and scaling.
• Deep container security knowledge (Kubernetes) and security across clouds and on‑prem.
• Hands-on experience deploying and tuning SAST, DAST, and CI/CD security tooling.
• Operational experience remediating via cloud security platforms and migrations.
• Proven track record securing large-scale platform migrations and microservices lifecycles.
• Nice to have: automotive/aerospace/defense sectors; HPC; open-source security work.

Responsibilities

• Analyze applications and architectures from inception to release, identifying vulnerabilities.
• Integrate robust security controls and conduct architecture reviews and threat modeling.
• Conduct regular security assessments and AI-assisted testing to mitigate vulnerabilities.
• Mature vulnerability management and drive risk-based remediation with dev teams.
• Provide guidance on secure coding practices and threat awareness to developers.
• Collaborate with incident response and remediation planning for product operations.
• Improve automated SAST/DAST tooling to secure CI/CD pipelines.

Skills

Python

TypeScript

AI

Threat modeling

SAST/DAST tooling

CI/CD security

Kubernetes

Cloud security (AWS/GCP/Azure)

Encryption protocols

Tools

Burp Suite

OWASP ZAP

Job description

Job Title: Product Security Engineer

Job Location: Sunnyvale, CA

Job Duration: Long Term Contract

About the role

We are seeking a multifaceted Product Security Engineer whose role will be to embed security directly into the product design and development lifecycle. Working closely with cross-functional engineering teams, you will play a crucial role in securing our application platform.

Roles:

• Analyze applications and system architectures from their inception to release. Proactively identify potential security vulnerabilities and integrate robust security controls and conduct architecture reviews and threat modeling.
• Conduct regular security assessments and utilize AI-assisted testing on products and systems to systematically identify and mitigate vulnerabilities before they can be exploited.
• Assist in maturing vulnerability management program and drive risk-contextualized resolutions discovered through various security platforms, collaborating closely with development teams.
• Provide continuous guidance and education to developers on secure coding practices, emerging threats, and general security best practices to cultivate a security-conscious culture.
• Collaborate with incident response teams and join security incident calls that impact product operations and create targeted remediation suggestions based on current threat landscapes.
• Work alongside software engineers to mature automated SAST and DAST tooling to secure development frameworks and CI/CD pipelines.

We're looking for someone who has:

• 5+ years of demonstrable experience as a Security Engineer, Application Security Engineer, or Product Security Engineer within a highly complex, rapidly scaling software organization.
• Proficiency in modern programming languages (such as Python, Typescript, etc.), knowledge of security tools (e.g., Burp Suite, OWASP ZAP), and familiarity with modern security protocols and encryption methods.
• Implemented AI to rapidly identify, validate, and scale security programs.
• Deep, practical knowledge of container security (Kubernetes), compute constraints, and securing ephemer workloads across major public cloud platforms (AWS, GCP, Azure) and on-premises environments.
• Hands-on experience deploying, tuning, and automating SAST, DAST, and CI/CD pipeline security tools.
• Specific operational experience configuring and driving remediation through cloud security platforms.
• Proven experience securing large-scale platform migrations and managing the distinct security lifecycles of both legacy systems and modern microservices.

Nice to have:

• Direct professional experience in the autonomous vehicle, automotive, aerospace, or defense sectors.
• Familiarity with physics-based simulation environments, deterministic computing constraints, or managing High-Performance Computing (HPC) clusters.
• Demonstrable contributions to open-source security tools, published vulnerability research, or recognized vulnerability disclosures (CVEs)