Product Security Engineer — SaaS & AI with Unlimited PTO

Merge; San Francisco (CA); On-site; USD 165,000 - 200,000; Full time

Benefits offered by this job

Unlimited PTO + 10 holidays

Health, vision, and dental insurance

Job summary

Merge is seeking a security engineer responsible for product and application security across our platform, including APIs, integrations, and AI-powered features. You will drive vulnerability remediation throughout the SDLC, build a mature security program with SAST/DAST tooling, and guide developers on secure design patterns.

You will also test resiliency using AI and manage the bug bounty program end to end.

Qualifications

• 3–6+ years of security engineering experience focused on product or application security.
• Familiarity with OWASP Top 10 and common vulnerability classes.
• Experience conducting threat modeling and secure code reviews.

Responsibilities

• Own product and application security across Merge's platform: APIs, integrations, and AI-powered features.
• Drive vulnerability identification and remediation across the full SDLC, from design to deployment.
• Build and mature the application security program with SAST/DAST tooling and CI/CD security guidance.
• Utilize AI to test the resiliency of applications and systems.
• Lead the bug bounty program end to end: triage, response, remediation, and researcher communication.

Skills

Security engineering

Application security

Threat modeling

CI/CD security

SAST/DAST tooling

Code reviews

Secure design patterns

Cloud security

Tools

SAST

DAST

SCA

CI/CD integration

Job description

Merge is seeking a security engineer responsible for product and application security across our platform, including APIs, integrations, and AI-powered features. You will drive vulnerability remediation throughout the SDLC, build a mature security program with SAST/DAST tooling, and guide developers on secure design patterns.

You will also test resiliency using AI and manage the bug bounty program end to end.