Product Security Engineer - Remote, High-Impact Security

YipitData (Alternative); New York (NY); On-site; USD 153,000 - 207,000; Full time

Benefits offered by this job

Flexible hours

401K match

Parental leave

Team events

Wellness budget

Learning reimbursement

Job summary

YipitData is seeking a Product Security Engineer to embed security throughout product development. You will partner with Engineering and Product teams, perform threat modeling, review architectures, and guide secure design before production releases.

You will own security tooling across the lifecycle (SAST, DAST, dependency and secret scanning) and help teams balance risk with agility. Remote-friendly within the US.

Qualifications

• Experience in product security or software engineering.
• Ability to threat model and review architecture.
• Understanding of secure design patterns and risk assessment.
• Familiarity with security tooling and development pipelines.

Responsibilities

• Lead threat modeling and security design reviews for new products.
• Assess architectures, APIs, authentication, authorization, and data flows.
• Identify and validate vulnerabilities; prioritize real risks.
• Design remediation plans with engineers to protect customers without hindering delivery.
• Own and improve security tooling across the lifecycle (SAST, DAST, secret scanning).
• Tune findings to reduce false positives and increase actionability.
• Build automation to scale security as products and AI usage grow.
• Develop secure design patterns and coding guidance for teams.
• Lead incident response for product security issues and root-cause analysis.

Skills

Identity security

Authentication

Authorization

Multi-tenant security

OWASP

CI/CD security

Cloud security

Tools

SAST

DAST

Dependency scanning

Secret scanning

IaC scanning

Job description

YipitData is seeking a Product Security Engineer to embed security throughout product development. You will partner with Engineering and Product teams, perform threat modeling, review architectures, and guide secure design before production releases.

You will own security tooling across the lifecycle (SAST, DAST, dependency and secret scanning) and help teams balance risk with agility. Remote-friendly within the US.