Senior Product Security Engineer

Staffbase; United States; Hybrid; USD 150,000 - 190,000; Full time

Benefits offered by this job

Hybrid work options

Annual flex allowance

31 vacation days per year

Company pension scheme

Volunteer day

Job summary

Staffbase, a global SaaS company, is seeking a Senior Product Security Engineer to embed security across the SDLC. The role blends hands-on software engineering with security expertise, focusing on automation, AI-driven vulnerability detection, and pipeline hardening.

You will partner with engineering teams, maintain a central HTML sanitization service in TypeScript, manage WAF and email security, and advance Kubernetes/CI/CD hardening. English is required; German is a plus.

Qualifications

• Practical experience with penetration testing and secure software development.
• Experience in vulnerability management, SAST, and DAST.
• Strong programming skills in TypeScript/JavaScript/Kotlin/Java/Go/Python.
• Experience with Unix and Kubernetes, Terraform, and Kustomize.
• Excellent written and verbal English; German a plus.

Responsibilities

• Build and refine security automation for build and deployment pipelines.
• Prototype and evaluate AI-based vulnerability detection/remediation approaches.
• Maintain central HTML sanitization service in TypeScript.
• Operate WAF rule sets and review outbound email security metrics.
• Apply Kubernetes and CI/CD hardening across the infrastructure footprint.
• Share vulnerability knowledge with product engineering teams and advise during development.

Skills

Penetration testing

Secure SDLC

Vulnerability management

SAST

DAST

TypeScript/JavaScript

Java

Kotlin

Go

Python

Terraform

Kustomize

Kubernetes

CI/CD

Tools

Terraform

Kustomize

Kubernetes

CI/CD pipelines

Job description

Role overview

The Senior Product Security Engineer plays a central role on a product security enablement team, partnering with engineering groups to embed security throughout the software development lifecycle. The position blends hands-on software engineering with security expertise, focusing on automation, pipeline hardening, and the exploration of AI-driven techniques for vulnerability detection and remediation. It operates within a global SaaS context where secure-by-default practices are treated as foundational rather than blocking.

Responsibilities

• Build and refine security automation that strengthens product build and deployment pipelines
• Prototype and evaluate AI-based approaches for identifying and remediating vulnerabilities
• Maintain and extend a central HTML sanitization service written in TypeScript
• Operate Web Application Firewall rule sets and review outbound email security metrics
• Apply Kubernetes and CI/CD hardening practices across the infrastructure footprint
• Share context-specific vulnerability knowledge with product engineering teams and act as a trusted advisor during development

Requirements

• Practical experience with security disciplines such as penetration testing, secure software development, vulnerability management, SAST, and DAST
• Strong programming skills in TypeScript, JavaScript, Kotlin, Java, Go, or Python
• Hands-on experience with Unix and Kubernetes infrastructure, ideally provisioned through Terraform and Kustomize
• Clear written and verbal communication skills in English; German is a plus

Benefits and work setup

• Competitive compensation package that includes a unit-based long-term incentive plan
• Flexible working time models with hybrid options and an annual flex work allowance
• Around 31 vacation days per year, plus additional scheduled days off during the summer period
• Company pension scheme
• One paid day off each year to support a social or community project