Product Security Engineer — AI-Powered SaaS Platform

Merge Labs; New York (NY); On-site; USD 165,000 - 200,000; Full time

Benefits offered by this job

Unlimited PTO

Pre-Tax commuter benefits

Health, vision & dental insurance

401K Plan

Home office stipend

In office snacks and dinner after 7pm

Job summary

Merge Labs is seeking a Security Engineer to own product and application security across the platform, collaborating with engineering and product to drive secure design and vulnerability remediation.

You will lead security reviews, threat modeling, and code reviews, while maturing our security program with SAST/DAST and CI/CD integration. Experience with SaaS/API-driven environments is highly valued.

Qualifications

• Experience in product/application security.
• Strong understanding of OWASP and secure API design.

Responsibilities

• Own product and application security across Merge's platform: APIs, integrations, agent tooling, and AI-powered features.
• Conduct security reviews, threat modeling, and code reviews focusing on application-layer vulnerabilities.
• Drive vulnerability identification and remediation across the full SDLC, from design through deployment.
• Build and mature the application security program with SAST/DAST tooling and CI/CD security guidance.
• Utilize AI to test resiliency of applications and systems.
• Own and operate the bug bounty program end to end: triage, remediation, researcher communication.
• Partner with Engineering to embed secure design patterns and security review into shipping software.
• Support infrastructure and cloud security in relation to the product surface.

Skills

Security engineering

Product security

Threat modeling

Code review

CI/CD security

Tools

SAST

DAST

SCA

CI/CD tooling

Job description

Merge Labs is seeking a Security Engineer to own product and application security across the platform, collaborating with engineering and product to drive secure design and vulnerability remediation.

You will lead security reviews, threat modeling, and code reviews, while maturing our security program with SAST/DAST and CI/CD integration. Experience with SaaS/API-driven environments is highly valued.