Senior Cloud Security Engineer – Product & CI/CD

International Business Machines Corporation; Lowell (MA); On-site; USD 140,000 - 210,000; Full time

Job summary

IBM is seeking a Senior Product Security Engineer in Lowell, MA to scale our product security function across cloud and on-prem offerings. You will partner with R&D teams to embed security throughout the development lifecycle, drive threat modeling, secure design reviews, and risk assessments while advancing our multi-cloud security posture.

You should bring 8+ years of product security experience, deep cloud security knowledge (AWS/Azure/GCP), and hands-on expertise in vulnerability

Qualifications

• 8+ years of product security experience, partnering closely with engineering teams to embed security throughout the development lifecycle.
• Strong security architecture expertise, including threat modeling, secure design reviews, and risk assessment.
• Deep cloud security knowledge across AWS, Azure, and/or GCP, with experience securing multi-tenant SaaS, IaaS, and PaaS environments.
• Hands-on application and infrastructure security experience, including secure development practices, security testing, vulnerability management, and remediation.
• Broad security program expertise, including identity and access management (SSO, SAML, OIDC, SCIM), cryptography fundamentals, security audits, vulnerability disclosure, and bug bounty programs.
• Modern engineering practices, processes, and tools, particularly related to the Go programming language and ecosystem.
• Knowledge of application security topics, a pragmatic approach to security, and the ability to empathize with engineers and product managers across the company.

Responsibilities

• Contribute to secure architecture and design of HashiCorp products, across our cloud, self-managed, and community product portfolio.
• Work across various R&D teams to prioritize security features and bugs, and ensure implementation and mitigations.
• Monitor threats and vulnerabilities impacting HashiCorp products and services; triage reported vulnerabilities, identify mitigations and assess/communicate associated risk.
• Act as SME on multiple information security areas (e.g. security architecture, application security, threat modeling etc.).
• Plan & execute security assessments (dynamic testing, static testing, code review, etc) and threat modeling of HashiCorp’s products, services, and associated cloud infrastructure.
• Assist in execution of 3rd-party audits, penetration tests, and bug bounty programs.
• Contribute to the development of security solutions across the product life-cycle, such as standalone security tools, CI/CD pipeline integrations, product security features/fixes, etc.
• Contribute to the creation and delivery of security training.
• Research emerging attack vectors and techniques.

Skills

Product security

Threat modeling

Security architecture

Cloud security

Vulnerability management

Identity & access management

Cryptography fundamentals

Security audits

Bug bounty

Go language

Education

Bachelor's Degree

Job description

IBM is seeking a Senior Product Security Engineer in Lowell, MA to scale our product security function across cloud and on-prem offerings. You will partner with R&D teams to embed security throughout the development lifecycle, drive threat modeling, secure design reviews, and risk assessments while advancing our multi-cloud security posture.

You should bring 8+ years of product security experience, deep cloud security knowledge (AWS/Azure/GCP), and hands-on expertise in vulnerability