Senior Product Security Engineer

IBM; City of Poughkeepsie (NY, AR); Presencial; USD 120 000 - 180 000; Tempo integral

Resumo da oferta

IBM Software is seeking a Product Security Engineer to partner with Vault, Boundary, and Radar engineering teams, embedding security throughout the product development lifecycle. You will act as a trusted security advisor, collaborating with Product Management, Engineering, and Security Operations to build secure-by-design solutions.

The role focuses on threat modeling, architecture reviews, vulnerability assessments, and secure software practices, with opportunities to contribute to automation

Qualificações

• 5+ years of experience in application security, product security, or security engineering.
• Expertise in threat modeling, architecture reviews, security design reviews, and vulnerability assessments.
• Knowledge of OWASP Top 10, CWE, CVSS, and secure software development principles.
• Proficiency in Go, Python, or Rust, with understanding of authentication, authorization, encryption, PKI, and secrets management.
• Experience with security automation and collaboration with cross-functional teams.

Responsabilidades

• Embed security throughout the PDLC with engineering teams for Vault, Boundary, and Radar.
• Act as security SME for Vault, Radar, Boundary, coordinating vulnerability disclosures and customer-facing security communications.
• Conduct architecture reviews, threat modeling, and security assessments for new products and platform initiatives.
• Provide guidance on secure design patterns, defensive architectures, and remediation strategies.
• Promote secure-by-design practices and security standards across engineering teams.
• Assess vulnerabilities, conduct risk and severity analyses, and prioritize remediation.
• Lead incident response activities, investigation, containment planning, and post-incident improvements.
• Contribute to automation and AI-assisted security tooling to scale vulnerability triage and remediation.

Conhecimentos

Application security

Threat modeling

Architecture reviews

Security design reviews

Vulnerability assessments

OWASP Top 10

CWE/CVSS

Go/Python/Rust

Identity & secrets management

Security automation

Formação académica

Bachelor's Degree

Ferramentas

HashiCorp Vault

HashiCorp Boundary

HashiCorp Radar

Terraform

Consul

Descrição da oferta de emprego

Introduction

At IBM Software, we transform client challenges into solutions. Building the world's leading AI-powered, cloud-native products that shape the future of business and society. Our legacy of innovation creates endless opportunities for IBMers to learn, grow, and make an impact on a global scale. Working in Software means joining a team fueled by curiosity and collaboration. You'll work with diverse technologies, partners, and industries to design, develop, and deliver solutions that power digital transformation. With a culture that values innovation, growth, and continuous learning, IBM Software places you at the heart of IBM's product and technology landscape. Here, you'l have the tools and opportunities to advance your career while creating software that changes the world.

Introduction

At IBM Software, we transform client challenges into solutions. Building the world's leading AI-powered, cloud-native products that shape the future of business and society. Our legacy of innovation creates endless opportunities for IBMers to learn, grow, and make an impact on a global scale. Working in Software means joining a team fueled by curiosity and collaboration. You'll work with diverse technologies, partners, and industries to design, develop, and deliver solutions that power digital transformation. With a culture that values innovation, growth, and continuous learning, IBM Software places you at the heart of IBM's product and technology landscape. Here, you'l have the tools and opportunities to advance your career while creating software that changes the world.

Your Role And Responsibilities

The Secure Lifecycle Management (SLM) organization is seeking a Product Security Engineer to partner closely with the engineering teams responsible for HashiCorp Vault, Boundary, and Radar. This role is embedded directly within the engineering organization and serves as a trusted security advisor throughout the Product Development Lifecycle (PDLC), helping teams build secure-by-design products, proactively identify risks, and respond effectively to security vulnerabilities and incidents. The ideal candidate combines deep application and product security expertise with strong software engineering skills and the ability to collaborate across Product Management, Engineering, Product Security, and Security Operations teams.

Roles and Responsibilities

• Partner directly with Vault, Boundary, and Radar engineering teams to embed security throughout the PDLC and improve the security posture of new and existing capabilities.
• Serve as the security SME for Vault, Radar, Boundary and work closely with central Product Security, and Security Operations teams on coordinated vulnerability disclosure, security advisories, and customer-facing security communications.
• Conduct architecture reviews, design reviews, threat modeling, and security assessments for new products, features, and platform initiatives.
• Provide actionable guidance to engineering teams on secure design patterns, defensive architectures, security controls, and remediation strategies.
• Help establish and promote secure-by-design engineering practices, security standards, and product-specific security best practices.
• Assess internally discovered and externally reported security vulnerabilities, including validation, exploitability analysis, risk assessment, severity determination, and remediation prioritization.
• Collaborate with engineering teams to identify workarounds, develop fixes, review remediation plans, and validate security improvements.
• Participate in security incident response activities, including investigation, impact assessment, containment planning, root cause analysis, and post-incident improvements.
• Assist in building and prototyping AI-assisted security tooling, workflows, and skills that improve the scale and efficiency of vulnerability triage, assessment, remediation, and security review activities.
• Contribute to automation and process improvements that reduce security response time and improve engineering productivity.

Preferred Education

Bachelor's Degree

Required Technical And Professional Expertise

• 5+ years of experience in application security, product security, or security engineering, with 8+ years of overall industry experience preferred.
• Secure Design & Risk Assessment: Expertise in threat modeling, architecture reviews, security design reviews, and vulnerability assessments.
• Vulnerability Management: Experience identifying, triaging, prioritizing, and assessing security vulnerabilities based on exploitability and business impact.
• Application Security Expertise: Strong knowledge of OWASP Top 10, CWE, CVSS, modern vulnerability management practices, and secure software development principles.
• Technical & Security Foundations: Proficiency in Go, Python, or Rust, with deep understanding of authentication, authorization, encryption, PKI, key management, identity, and secrets management, along with a proven ability to influence teams and drive secure engineering practices.

Preferred Technical And Professional Experience

• Application & Cloud Security: Hands-on experience with static and dynamic analysis, software composition analysis (SCA), container security, cloud security tools, and vulnerability research.
• Security Operations & Communication: Experience with incident response, coordinated vulnerability disclosure, security advisories, and customer-facing security communications.
• Security Engineering & Automation: Familiarity with HashiCorp technologies, including Vault, Boundary, Consul, Terraform, and Radar, along with experience building security automation, developer security tools, or AI-assisted security workflows.
• Education: Bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or equivalent practical experience.