Senior Product Security Engineer

Snyk; Boston (MA); On-site; USD 192,000 - 230,000; Full time

Benefits offered by this job

Flexible working hours

Work-from-home allowance

Vacation and wellness time off

Health benefits

Job summary

Snyk is seeking a Senior Product Security Engineer (Platform) to strengthen cloud security across GCP and AWS. You will pair infrastructure expertise with AI coding agents to translate threat models into Terraform, Kubernetes, and pipeline fixes, collaborating with platform teams to merge changes safely.

Ideal candidates have 5–8 years of hands-on cloud security experience, deep GCP knowledge, and practical Kubernetes.

Qualifications

• 5-8 years running or securing cloud infrastructure
• Deep, hands-on GCP knowledge, plus AWS familiarity
• Strong grasp of GCP IAM and workload identity federation
• Kubernetes and container experience on GKE (RBAC, network policy)
• Proficiency with infrastructure as code (Terraform) and CI/CD pipelines

Responsibilities

• Threat model cloud infrastructure across GCP and AWS
• Draft Terraform, Kubernetes, and pipeline changes using AI agents
• Run agent-driven fixes at scale with review by owning teams
• Write guidance and prompts for AI agents to ensure reliability
• Integrate AI agents with live cloud, CSPM data and ticketing systems
• Review AI-generated changes for safety and accuracy
• Harden IAM, including policies and service accounts
• Improve Kubernetes security on GKE including control planes and security pipelines
• Add automated security testing and CSPM tooling to CI/CD
• Benchmark against CIS and NIST frameworks
• Mitigate AI agent risks like prompt injection and over-broad permissions
• Measure impact across teams and iterate

Skills

GCP security

AWS security

Kubernetes

Terraform

CI/CD

DevSecOps

Threat modeling

IAM management

AI agents

Policy & governance

Tools

Claude Code

CI/CD tooling

Job description

Job Summary

Snyk is the leader in secure AI software development, helping millions of developers develop fast and stay secure as AI transforms how software is built. Our AI-native Developer Security Platform integrates seamlessly into development and security workflows, making it easy to find, fix, and prevent vulnerabilities — from code and dependencies to containers and cloud. Our mission is to empower every developer to innovate securely in the AI era — boosting productivity while reducing business risk. We’re not your average security company - we build Snyk on One Team, Care Deeply, Customer Centric, and Forward Thinking. It’s how we stay driven, supportive, and always one step ahead as AI reshapes our world.

Snyk's Product Security team works consultatively with the engineering teams that build and run our cloud platform: we identify the security requirements, agree together on what needs to change, and the owning teams implement it.

As a Senior Product Security Engineer (Platform), you'll pair deep GCP and AWS infrastructure experience with AI coding agents to turn threat models into concrete Terraform, Kubernetes, and pipeline fixes, then work directly with platform teams to get those fixes merged. The goal is simple to state and hard to do well: make the secure option the easy option for the engineers building Snyk's platform.

About the Team

You’ll join Snyk's Product Security team, which operates as an advisor rather than an owner: the cloud infrastructure teams retain ownership and operation of their systems, and Product Security's job is to find what needs to change and make that change easy to ship. The team sits close to Snyk's platform and infrastructure organization and is increasingly built around AI agents doing real infrastructure work, not just reviewing someone else's.

What You’ll Do

• Threat model Snyk's cloud infrastructure across GCP and AWS to identify the security requirements platform teams need to meet, then negotiate the resulting changes directly with the teams that own the systems.
• Use AI coding agents (for example Claude Code) to draft the Terraform, Kubernetes, and pipeline changes that fix identified security gaps, and raise them for the owning team to review and merge.
• Run agent-driven fixes at scale across many repositories, scoping every change so the owning platform team can review and merge it with confidence.
• Write and maintain the guidance AI agents rely on (skills, prompts, instruction files, security baselines) so agent output consistently matches Snyk's standards.
• Connect agents to live cloud, CSPM, and ticketing data through MCP servers, command-line tools, and provider APIs so their fixes are grounded in the real environment.
• Review AI-generated infrastructure changes critically: catch invented resources, unsafe defaults, and IAM permissions scoped wider than they need to be.
• Harden GCP identity and access management, including the resource hierarchy, IAM roles and conditions, service accounts and workload identity federation, and organization policy constraints, plus the AWS IAM equivalent.
• Improve Kubernetes and container security, primarily on GKE: cluster hardening (private clusters, Autopilot), RBAC, admission control, workload identity, network policy, and secure container image pipelines (Artifact Registry, Binary Authorization).
• Add automated security testing and CSPM tooling to CI/CD and GitOps pipelines, then help teams triage and fix what those tools surface.
• Benchmark infrastructure against secure configuration baselines such as the CIS Google Cloud Foundation Benchmark, and against the infrastructure controls in frameworks like ISO 27001 and NIST 800-53.
• Limit the risks AI agents themselves introduce: prompt injection, over-broad permissions, leaked secrets, and changes made without review.
• Measure whether agent-driven fixing is actually working across teams, and improve the approach as you learn what does and doesn't land.

What you’ll bring

• 5-8 years running or securing cloud infrastructure, ideally having built and operated production platforms on GCP or AWS before moving into security.
• Deep, hands‑on GCP knowledge, including its security services, plus a good working knowledge of AWS; equivalent AWS IAM depth is a bonus.
• Strong grasp of GCP IAM: resource hierarchy (organization, folders, projects), IAM roles and conditions, service accounts and workload identity federation, organization policy constraints, and least privilege design.
• Practical Kubernetes and container experience, primarily GKE: cluster hardening (private clusters, Autopilot), RBAC, admission control, workload identity, network policy, and secure container images. EKS experience is also welcome.
• Comfort with infrastructure as code (for example Terraform) and automated deployment: CI/CD pipelines and GitOps.
• Solid DevSecOps practice: threat modeling, early shift‑left testing, and continuous monitoring, plus the judgment to turn that into concrete infrastructure changes.
• Confidence using AI coding agents (for example Claude Code) day to day, including writing the guidance and prompts that keep their output reliable at scale.
• A critical eye for AI‑generated infrastructure output: able to spot invented resources, unsafe defaults, and overly broad IAM permissions before anything ships.
• Comfort working consultatively: influencing and negotiating changes with teams who own and run the infrastructure, rather than owning it yourself.
• Nice to have: application security knowledge (for example code review, OWASP Top 10), or experience with Snyk's products or similar security testing tools.

Compensation

Annual Base Salary Range: $192,000 – $230,000 Snyk is committed to equal pay for equal work and carefully considers a wide range of compensation factors. Actual compensation may vary based on prior experience, skills, location, internal equity, and other job-related factors.

We care deeply about the warm, inclusive environment we’ve created and we value diversity – we welcome applications from those typically underrepresented in tech.

About Snyk

Snyk is committed to creating an inclusive and engaging environment where our employees can thrive as we rally behind our common mission to make the digital world a safer place.

From Snyk employee resource groups, to global benefits that help our employees prioritize their health, wellness, financial security, and a work/life blend, we aim to support our employees along their entire journeys here at Snyk.

Every day, the world gets more digital thanks to tens of millions of developers building the future faster than ever. But with exponential growth comes exponential risk, as outnumbered security teams struggle to secure mountains of code. This is where Snyk (pronounced “sneak”) comes in. Snyk is a developer security platform that makes it easy for development teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and cloud infrastructure — and do it all right from the start.

Snyk is on a mission to make the world a more secure place by empowering developers to develop fast and stay secure. Joining Snyk means embracing our core values: One Team, Care Deeply, Customer Centric, and Forward Thinking. As a member of our team, you’ll have the opportunity to thrive in a dynamic environment where fostering collaboration, leading with empathy, driving business impact, and inspiring trust are at the heart of everything we do.

Benefits & Programs

• Prioritize health, wellness, financial security, and life balance with programs tailored to your location and role.
• Flexible working hours, work-from home allowances, in-office perks, and time off for learning and self development.
• Generous vacation and wellness time off, country-specific holidays, and 100% paid parental leave for all caregivers.
• Health benefits, employee assistance plans, and annual wellness allowance.
• Country-specific life insurance, disability benefits, and retirement/pension programs, plus mobile phone and education allowances.