Senior Product Security Engineer

Priority Commerce; United States; Remote; USD 150,000 - 210,000; Full time

Job summary

Priority Commerce is seeking a Senior Product Security Engineer to embed security across the SDLC. You will partner with Engineering, Product, Legal, and Compliance to identify and mitigate risks, influence secure architecture, and guide engineers in secure-by-design practices.

You will lead security design reviews, drive secure coding standards, and mature security tooling across CI/CD and cloud environments, while contributing to PCI-DSS and SOC 2 Type II compliance efforts.

Qualifications

• 5 years of experience in application security, product security, or a closely related technical role (e.g., DevOps or Application Development).
• Deep expertise in at least two of: web application security, API security, mobile security, or cloud security (AWS preferred).
• Strong proficiency in one or more programming languages (Python, Java, JavaScript, etc.).
• Experience with modern software development and application security tooling (SAST, DAST, SCA).
• Hands-on experience with threat modeling methodologies applied to complex distributed systems.
• Familiarity with security frameworks and standards relevant to fintech such as PCI-DSS, SOC 2 Type II, FFIEC, NIST CSF, and ISO 27001.
• Strong written and verbal communication skills with the ability to communicate effectively with both technical and business audiences.

Responsibilities

• Own security design reviews and threat modeling for high-risk product areas including payment processing, identity and access, fraud systems, and AI.
• Serve as a technical security authority for staff and principal engineers, providing guidance on secure architecture patterns, cryptography, and API security.
• Lead and execute application security assessments, red team exercises, and adversarial simulations against production and pre-production environments.
• Define and drive adoption of security standards, secure coding guidelines, and SAST/DAST/SCA tooling across engineering teams.
• Partner with the Engineering and DevOps teams to mature the security posture of CI/CD pipelines, cloud infrastructure, and container environments.
• Translate complex security risks into clear, prioritized recommendations for engineering leadership and product managers.
• Contribute to the team's regulatory compliance posture across PCI-DSS, SOC 2 Type II, and other applicable regulatory guidance.

Skills

Application security

Threat modeling

Security tooling

Strong communication

Programming languages

Tools

SAST tooling

DAST tooling

SCA tooling

Job description

Job title: Senior Product Security Engineer

Reports to: Manager, Application Security

Department: Central Services

Location: Remote

Grade: 19

About Priority

Priority Commerce is a leading financial technology company on a mission to deliver a personalized, easy-to-adopt financial toolset that accelerates cash flow and optimizes working capital for businesses. Our vision is to eliminate the barriers to unlocking revenue - empowering businesses to grow faster and operate smarter.

We achieve this through the Priority Commerce Engine, an innovative platform that combines payables, acquiring, and banking and treasury solutions. This unified approach allows businesses to streamline financial operations, reduce unnecessary costs, and uncover new revenue opportunities.

At Priority Commerce, we're driven by results. We expect our people to be known for results - bringing expertise, momentum, and relentless focus to every challenge, helping our clients and each other thrive.

About the Role

The Product Security Engineer plays a key role in embedding security throughout the software development lifecycle by partnering closely with Engineering, Product, Legal, and Compliance teams. This role is responsible for identifying and mitigating security risks, influencing secure architecture decisions, and helping engineers build secure products by design. The position requires deep technical expertise in application and product security, strong communication skills, and the ability to translate complex security concepts into practical guidance. You will contribute to securing Priority's commerce platform while helping scale security practices, tooling, and frameworks across the organization.

Responsibilities

• Own security design reviews and threat modeling for high-risk product areas including payment processing, identity and access, fraud systems, and AI.
• Serve as a technical security authority for staff and principal engineers, providing guidance on secure architecture patterns, cryptography, and API security.
• Lead and execute application security assessments, red team exercises, and adversarial simulations against production and pre-production environments.
• Define and drive adoption of security standards, secure coding guidelines, and SAST/DAST/SCA tooling across engineering teams.
• Partner with the Engineering and DevOps teams to mature the security posture of CI/CD pipelines, cloud infrastructure, and container environments.
• Translate complex security risks into clear, prioritized recommendations for engineering leadership and product managers.
• Contribute to the team's regulatory compliance posture across PCI-DSS, SOC 2 Type II, and other applicable regulatory guidance.

What Success Looks Like

Engineering teams treat you as a trusted security partner, not a gatekeeper, and they pull you into design conversations early because it makes their work better, not because they have to.

Threat models and security design reviews are completed at the right stage of the SDLC, reducing the volume of critical findings that reach production.

The security tooling (SAST, DAST, SCA) is adopted, tuned, and producing signal rather than noise with engineers acting on findings rather than ignoring them.

High-risk product areas (AI, payments, identity, fraud) have documented security architectures and known risk posture at all times.

Regulatory audits and customer security assessments in your domain produce no surprises, because controls are built in and well-evidenced.

Security debt in your areas of ownership is tracked, prioritized, and visibly decreasing over time.

Candidate Requirements

Required

• 5 years of experience in application security, product security, or a closely related technical role (e.g., DevOps or Application Development).
• Experience in application security, product security, or a closely related technical role.
• Deep expertise in at least two of the following security domains: web application security, API security, mobile security (iOS/Android), or cloud security (AWS preferred).
• Strong proficiency in one or more programming languages (Python, Java, JavaScript, etc.), demonstrating the ability to read, write, and reason about production code.
• Experience with modern software development and application security tooling (SAST, DAST, SCA, etc.).
• Hands‑on experience with threat modeling methodologies applied to complex distributed systems.
• Familiarity with security frameworks and standards relevant to fintech such as PCI‑DSS, SOC 2 Type II, FFIEC, NIST CSF, and ISO 27001.
• Strong written and verbal communication skills with the ability to communicate effectively with both technical and business audiences.

Preferred

• Experience securing fintech, payments, or regulated financial products.
• Experience supporting cloud‑native architectures and modern CI/CD environments.
• Experience participating in red team exercises, penetration testing, or adversarial simulations.
• Security certifications such as CI