Product Security Engineer: SSDLC Lead & Threat Modeling

Bloomreach; United States; Remote; USD 120,000 - 170,000; Full time

Benefits offered by this job

Virtual-first work model

Equity participation

Annual professional development budget

Bonuses and leave

Job summary

Hidden Jobs is seeking a Security Engineer within our product security organization to embed security across the SDLC for a large personalization platform serving enterprise brands.

You will partner with engineering, DevOps and compliance, lead threat modeling sessions (STRIDE), conduct assessments, triage vulnerabilities, and drive remediation with stakeholders to reduce risk. This role emphasizes collaboration and clear communication with non-security audiences.

Qualifications

• 2+ years of hands-on experience in application security, product security, or related discipline.
• Practical exposure to security assessments and web app pen testing.
• Familiarity with STRIDE threat modeling.
• Working knowledge of vulnerability management and remediation tracking.
• Understanding of modern application architectures, APIs, and web security risks.
• Familiarity with OWASP Top 10, Testing Guide, and tools like Burp Suite and OWASP ZAP.

Responsibilities

• Champion Secure Software Development Lifecycle (SSDLC) adoption across engineering squads and help integrate security checkpoints into existing workflows.
• Review application designs, system architectures, and infrastructure components to surface risks and recommend mitigations.
• Lead or contribute to threat modeling sessions using approaches such as STRIDE, producing practical recommendations that engineering teams can act on.
• Conduct security assessments, penetration testing, and validation exercises across web applications and supporting environments.
• Triage, validate, and assign vulnerabilities surfaced by automated tooling and manual testing, then drive remediation with stakeholders.
• Act as a security point of contact for the assigned domain, escalating complex or high-risk issues to senior security staff as needed.

Skills

Application security

Threat modeling (STRIDE)

Vulnerability management

Web security testing

OWASP tools

APIs & auth concepts

Tools

Burp Suite

OWASP ZAP

Nmap

SAST/SCA platforms

Job description

Hidden Jobs is seeking a Security Engineer within our product security organization to embed security across the SDLC for a large personalization platform serving enterprise brands.

You will partner with engineering, DevOps and compliance, lead threat modeling sessions (STRIDE), conduct assessments, triage vulnerabilities, and drive remediation with stakeholders to reduce risk. This role emphasizes collaboration and clear communication with non-security audiences.