Security Engineer, Product Security

Jobgether; United States; Remote; USD 130,000 - 190,000; Full time

Benefits offered by this job

Remote work within the United States

Competitive salary

Medical, dental, and other benefits

Equity opportunities

Flexible time off

Modern hardware and tools

Job summary

Jobgether is seeking a Security Engineer, Product Security in the United States. You will shape security architecture across a broad portfolio, drive threat modeling, and lead reviews for high-risk features while embedding secure-by-default practices.

This role blends hands-on security work with guiding engineering standards, building scalable programs, mentoring engineers, and influencing security culture across a globally distributed team. Remote within the US.

Qualifications

• Typically 2–5 years in product security or secured software.
• Strong knowledge of OWASP Top 10 and web app security.
• Experience with cloud providers such as AWS, GCP or Azure.

Responsibilities

• Define security architecture and reusable patterns for secure-by-default development.
• Lead security engineering reviews for high-risk features.
• Drive threat modeling and assess attack surfaces across product environments.
• Partner with engineering to resolve complex security tradeoffs.
• Strengthen vulnerability management and triage for reports.
• Drive remediation of systemic vulnerabilities rather than isolated findings.
• Own security services and tooling used by product teams globally.
• Develop security training and champions across the organization.
• Provide technical leadership and mentorship to security engineers.
• Participate in security operations and on‑call rotation.

Skills

Threat modeling

Security architecture

Vulnerability management

Security reviews

Developer enablement

Mentoring

Tools

Burp Suite

OWASP ZAP

SAST tools (Cycode/Semgrep/Snyk)

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Engineer, Product Security based in the United States. The Security Engineer, Product Security will help shape and strengthen the security architecture of a broad portfolio of products and services. This role focuses on embedding secure-by-default principles into product development through architecture guidance, threat modeling, vulnerability management, and developer enablement. You will lead security reviews for high-risk product features, establish reusable security patterns, and help engineering teams make informed architectural decisions. Beyond individual assessments, you will build scalable programs and tools that extend security expertise across a large, globally distributed engineering organization. Working closely with product, platform, infrastructure, and engineering teams, you will address systemic risks and improve security throughout the software development lifecycle. This is an opportunity to combine hands‑on technical security work with meaningful influence over engineering standards, practices, and culture.

Accountabilities

• Define security architecture and strategy: Establish security architecture for products and services, developing reusable patterns and reference implementations that make secure‑by‑default development the easiest path for engineering teams.
• Lead security engineering reviews: Conduct and guide security reviews for high‑risk product features, set consistent technical quality standards, and establish expectations for reviews conducted by other team members.
• Drive threat modeling and attack surface analysis: Lead domain‑specific threat modeling and assess attack surfaces across the broader product environment, identifying architectural risks beyond individual features.
• Partner on technical decisions: Work with engineering leadership to evaluate and resolve complex security tradeoffs and guide secure product design.
• Strengthen vulnerability management: Set standards for triaging, reproducing, and prioritizing bug bounty submissions and internal security reports, while personally handling the most complex or highest‑severity cases.
• Address systemic vulnerabilities: Drive remediation of recurring vulnerability classes and underlying security weaknesses rather than focusing solely on isolated findings.
• Own security services and tooling: Manage the security services and tools used by product engineering teams across global infrastructure.
• Develop security capabilities across engineering: Build and scale the security champions program and product security training, extending security knowledge and judgment throughout the engineering organization.
• Provide technical leadership: Mentor fellow security engineers and serve as a trusted technical authority on product security across engineering leadership.
• Participate in security operations: Contribute to the security on‑call rotation and support work across security disciplines as needed.

Requirements

• Typically 2–5 years of experience in product security, application security, or software development with a security focus. Demonstrated skills and practical work are valued more than an exact number of years.
• Strong understanding of web application security principles and common attack vectors, including the OWASP Top 10.
• Proficiency with application security testing tools such as Burp Suite, OWASP ZAP, or browser developer tools.
• Working knowledge of at least one modern programming language, such as Ruby, Java/Kotlin, TypeScript/JavaScript, or Python.
• Experience working with at least one major cloud provider, such as AWS, Google Cloud Platform (GCP), or Microsoft Azure.
• Ability to assess application and architectural risks, conduct threat modeling, and collaborate effectively with software engineers on secure design decisions.
• Comfort participating in a security on‑call rotation and taking on responsibilities across different security disciplines when required.
• Strong communication and collaboration skills, with the ability to explain security risks, influence engineering decisions, and help teams adopt practical security practices.

Nice to Have

• Hands‑on experience working with bug bounty platforms.
• Familiarity with Static Application Security Testing (SAST) tools such as Cycode, Semgrep, Snyk, or similar solutions.
• Experience with cloud infrastructure security and container technologies.
• Participation in Capture the Flag (CTF) events or contributions to open‑source security projects.
• Familiarity with threat modeling frameworks and secure software development lifecycle (SDLC) best practices.
• Interest or experience in contributing to internal developer security training programs.

Benefits

• Competitive, location‑based salary ranges:
  • California: $130,950–$202,125 USD.
  • Washington: $147,000–$183,750 USD.
  • Colorado: $148,210–$163,688 USD.
  • New York City: $147,000–$183,750 USD.
  • Illinois: $148,210–$163,688 USD.
• Bonus and equity opportunities as part of the total rewards package.
• Comprehensive medical, dental, and other benefit offerings.
• Flexible time off.
• Remote work opportunity within the United States.
• Access to modern hardware and software, including advanced AI models from the first day.
• Collaboration with globally distributed teams through Slack, video calls, and asynchronous documentation.
• An agile working environment where teams have flexibility to determine the practices that best support their work.
• Opportunity to influence security standards and architecture across a large engineering organization, with close collaboration between platform, security, and infrastructure teams.