Remote Principal Product Security Engineer

iHerb Inc.; California, Northern (MO, KY); Hybrid; USD 177,000 - 225,000; Full time

Job summary

iHerb is seeking a Principal Product Security Engineer to lead the Secure Development Lifecycle and security automation across products. You will shape security capabilities, grow the team, and partner with senior leaders to drive company-wide security initiatives.

The role requires a hands-on leader with extensive security expertise across cloud, web apps, and APIs, working with global development teams. Remote work in the US is supported.

Qualifications

• Demonstrated technical foundation with ability to translate vulnerabilities into risks.
• 10+ years of technical security leadership at a top-tier software company.
• Strong knowledge of OWASP Top 10 and related mitigations.
• Experience implementing SDL, automation, and DevOps integration.
• Experience with large-scale web apps and microservices including APIs.
• Familiarity with major languages: Python, C#/.NET, JavaScript, Node.js, Java.
• Strong problem solving, collaboration and communication skills.
• Experience in supply chain security.

Responsibilities

• Lead cross-functional projects and establish modern SDL practices.
• Directed security design reviews and threat modelling for services.
• Evaluate, prototype, and operate security-focused tools and services.
• Create secure architecture standards and patterns across layers.
• Identify emerging threats and implement centralized mitigations.
• Evaluate, prototype, and operate DAST, SAST, SCA tools.
• Maintain knowledge of current threats and best practices.
• Drive security assessments, pentesting and bug bounty programs.
• Participate in security incident response.

Skills

Security leadership

Threat modelling

DevOps security

Web app security

APIs & microservices

Programming languages

Analytical thinking

Communication

Supply chain security

Education

CS/Engineering degree

Tools

DAST

SAST

SCA

Cloudflare

AWS

Docker

Job description

iHerb is seeking a Principal Product Security Engineer to lead the Secure Development Lifecycle and security automation across products. You will shape security capabilities, grow the team, and partner with senior leaders to drive company-wide security initiatives.

The role requires a hands-on leader with extensive security expertise across cloud, web apps, and APIs, working with global development teams. Remote work in the US is supported.