Product Security Engineer: Red Team & Pen Testing — Equity

xage, inc; Palo Alto (CA); On-site; USD 140,000 - 170,000; Full time

Benefits offered by this job

Visa transfers and immigration

Job summary

Xage, headquartered in Palo Alto, seeks a Product Security Engineer focused on red team testing and threat modeling. You’ll perform manual penetration testing across Web UIs, REST/gRPC APIs, desktop clients, and backend services, with automation support as needed.

This role emphasizes collaboration across teams to improve secure design. Ideal candidates bring multi-year offensive security experience, strong coding ability to read product code, and expertise in OAuth, SAML, mTLS, RBAC/ABAC, and

Qualifications

• Multiple years of hands-on offensive security experience (pentesting, red teaming, vulnerability research).
• Able to read and understand code across product features to uncover vulnerabilities.
• Strong knowledge of OAuth, SAML, mTLS, SSO, RBAC/ABAC models.
• Deep Web and API security expertise; familiar with OWASP Top 10 and threat modeling.
• Excellent written and verbal communication; able to mentor teammates.

Responsibilities

• Conduct offensive security testing of Xage products across Web UIs, APIs, desktop clients, and backend services.
• Review feature designs and provide security input to guide architecture and development.
• Document findings with reproducible steps; collaborate with developers to remediate and verify fixes.

Skills

Offensive security

Penetration testing

Red teaming

Coding proficiency

OAuth/SAML

mTLS/PKI

RBAC/ABAC

OWASP Top 10

Web security

API security

Job description

Xage, headquartered in Palo Alto, seeks a Product Security Engineer focused on red team testing and threat modeling. You’ll perform manual penetration testing across Web UIs, REST/gRPC APIs, desktop clients, and backend services, with automation support as needed.

This role emphasizes collaboration across teams to improve secure design. Ideal candidates bring multi-year offensive security experience, strong coding ability to read product code, and expertise in OAuth, SAML, mTLS, RBAC/ABAC, and