Security Engineer - Product Security

UTA Ventures; New York (NY); In loco; USD 120.000 - 180.000; Tempo pieno

Vantaggi offerti da questo lavoro

Inclusive and diverse culture

Competitive well-being programs

Collaborative growth environment

Descrizione del lavoro

UTA is seeking a Product Security Engineer to define and drive the security strategy for its software products. You will partner with product and engineering leadership to set security requirements and roadmaps across teams, run threat modeling workshops, and review cloud deployments across AWS/Azure/GCP to mitigate risks.

You will mature the secure development lifecycle, promote automated checks in CI/CD, and lead security testing with both tools and manual reviews.

Competenze

• Bachelor’s degree or equivalent practical experience.
• 3+ years in security engineering, application security, or product security.
• Familiarity with OWASP Top 10 and practical remediation at scale.
• Experience securing applications in AWS/Azure/GCP and cloud-native architectures.
• Knowledge of SAST/DAST/SCA, secrets scanning, and CI/CD integration.
• Familiarity with Terraform, CI/CD security, and IaC reviews.
• Container security with image hardening, Kubernetes RBAC, network policies.
• Experience collaborating with software engineering teams in agile environments.
• Identity, authentication, and authorization concepts (OAuth, OIDC, SSO).
• Strong communication and stakeholder management.

Mansioni

• Support security design and architecture reviews for products and services across web, mobile, and cloud apps.
• Partner with leadership to define security requirements and roadmaps across teams.
• Lead threat modeling workshops to identify risks and drive mitigations.
• Conduct security reviews for cloud deployments (AWS/Azure/GCP).
• Drive secure SDLC, including threat modeling, secure coding, testing, and release validation.
• Promote automated security checks in CI/CD pipelines (SAST, DAST, SCA, secrets).
• Coordinate security testing and remediation with development teams.
• Establish secure coding standards and reusable patterns across engineering teams.
• Support API security assessments (OAuth, GraphQL, API gateway reviews).
• Collaborate with security operations to integrate logs and incidents.

Conoscenze

Security engineering

Communication

Stakeholder management

Identity and access management

Agile collaboration

Formazione

Bachelor's degree in CS/Cybersecurity or related field

Strumenti

SAST

DAST

SCA

WAF

GitHub Actions

Terraform

Kubernetes RBAC

Descrizione del lavoro

What You Will Do

Product security strategy & architecture

• Support security design and architecture reviews for new and existing products, including web, mobile, and cloud-based custom applications, and provide clear, actionable recommendations.
• Partner with product and engineering leadership to define product security requirements, risk tolerances, and security roadmaps across multiple teams and initiatives.
• Conduct and facilitate threat modeling workshops to proactively identify emerging risks and attack vectors and drive mitigations into product design.
• Conduct security reviews for products and services deployed across AWS, Azure, and GCP including cloud-native architectures, and platform-specific security controls.

Secure development lifecycle & testing

• Own and mature the application and product security lifecycle, including threat modeling, secure design, secure coding practices, testing, and release validation.
• Assess and secure early-stage product design, architecture and workflows, associated with rapid prototyping and deployment
• Drive the adoption of automated security checks in CI/CD pipelines (SAST, DAST, SCA, secrets scanning, etc.) and ensure they are tuned to balance risk reduction with developer velocity.
• Support and coordinate application security testing efforts, including tool-based and manual reviews, and work closely with development teams to prioritize and remediate findings.
• Establish and evangelize secure coding standards, patterns, and reusable frameworks that can be leveraged across engineering teams.
• Support API security assessments, including authentication/authorization validation for REST/GraphQL APIs and API gateway configuration reviews.

Operations, monitoring & incident response

• Collaborate with security operations to ensure product-related logs, alerts, and events are captured, correlated, and integrated into monitoring and incident response workflows.
• Support vulnerability triage and management for product and application findings, including those surfaced through penetration tests and attack surface monitoring, covering risk assessment, remediation planning, and validation of fixes.
• Ensure products handle sensitive data appropriately, including data classification, storage, transit, and retention practices aligned with organizational security requirements.

Tooling, enablement & leadership

• Evaluate, select, and help implement product security focused tools and services, influencing build vs buy decisions.
• Develop documentation, playbooks, and training to raise the overall level of security awareness and capability across product and engineering teams.
• Provide best practices on the secure use of AI-assisted development tools, including risks around dependency integrity, code suggestions, and agent-driven changes.

What You Will Need

• Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related field; or equivalent practical experience
• 3+ years of experience in security engineering, application security, or product aligned security roles, with a track record of owning and driving security initiatives
• Familiarity with common web, mobile, and API vulnerabilities (e.g., OWASP Top 10) and practical experience preventing and remediate them at scale
• Experience securing applications and services in at least one major cloud provider (AWS preferred), including cloud native architectures
• Knowledge of application security tooling (SAST, DAST, SCA, secret scanning, WAF, or similar) and integrating these into CI/CD workflows
• Familiarity with secure deployment practices, including Infrastructure-as-Code review of Terraform, CI/CD pipeline security (GitHub Actions), and secrets management.
• Familiarity with container security, including image hardening, Kubernetes RBAC, network policies, and runtime protection.
• Familiarity with securing AI/ML platforms in cloud environments and agentic workflows, including access control, data protection, and governance across the application development and deployment lifecycle.
• Some experience collaborating with software engineering teams in agile environments, including participating in design reviews, code reviews, and sprint planning
• Knowledge of identity, authentication, and authorization concepts and technologies (e.g., OAuth, OIDC, SSO, modern identity platforms)
• Excellent communication and stakeholder management skills, with the ability to influence senior technical and nontechnical partners and drive consensus

What You Will Get

• The unique and exciting opportunity to work at one of a leading global entertainment companies
• Access to the tools, leadership, and resources you will need to create and drive a center of excellence
• The opportunity to do the best work of your career
• Work in an inclusive and diverse company culture
• Competitive programs to support your well-being
• Experience working in a collaborative environment with room to grow

About UTA

UTA is a premier global talent agency built for the future of media and entertainment. The agency's diversified platform and best-in-class, client-first approach is innovative, collaborative, and positioned to lead in an evolving market. UTA represents the most celebrated artists, creatives, and brands, from icons and legends to next-generation talent. Its integrated capabilities span film and television, music, comedy, creators, sports, brands, news, publishing, speakers, theater, and more. It is based in Los Angeles with offices in the U.S., London, and Munich.

For more information: [UTA and its Affiliated Companies are Equal Employment Opportunity employers and welcome all job seekers.