Senior Product Security Engineer — Lead Cloud & App Security

Skylight; United States; On-site; USD 200,000 - 250,000; Full time

Benefits offered by this job

Salary + Equity package

401K matching

Wellness & learning budgets

Medical plans (H/D/V)

Autonomy in direction of work

Unlimited PTO

Company holidays on first Friday of每月

Job summary

Skylight is seeking a security-focused product engineer to own the day-to-day execution of the product security program across cloud backend, mobile apps, and Android platform. You will triage vulnerabilities, run bug bounty, maintain AI-powered scanning, and partner with product and engineering on design reviews before new features ship.

You will work with the Head of Security, ship fixes when needed, and provide metrics to leadership.

Qualifications

• 6+ years in application or product security with a software engineering background.
• Deep experience securing backend services and APIs (OAuth 2.0/OIDC, PKCE, MFA, session management, token handling).
• Experience building and maintaining security tooling and automation (static analysis, CI integrations, custom scanners), and comfort with LLM-based systems.
• Hands-on experience running or triaging a bug bounty program.
• A track record of getting engineering teams to prioritize and fix security issues through influence and good judgment, not escalation.
• Clear written communication and the ability to explain risk to both engineers and non-technical stakeholders.

Responsibilities

• Own the vulnerability management pipeline end to end: intake, triage, prioritization, and driving fixes to closure against defined remediation SLAs across Backend, Mobile, and Android teams
• Join our Platform pod where, with the team, you’ll write and ship security fixes directly in our codebases
• Own and evolve our AI security scanning and verification pipeline. Tune it to reduce false positives, extend coverage to new repositories, and integrate it into CI
• Run our HackerOne bug bounty program: triage reports, validate findings, work with researchers, decide on payouts, and manage the vendor relationship
• Manage third-party penetration testing engagements from scoping through remediation
• Lead security design reviews and threat modeling for new features and products, including AI/LLM-powered features and products that handle children's data
• Review and advise on device and firmware security work led by our firmware team
• Provide metrics and data on findings, remediation, and SLA adherence to support compliance and leadership reporting
• Serve as a subject matter expert during product security incidents

Skills

Application security

Software engineering

Backend API security

Bug bounty program

Security tooling

LLM security

Clear communication

Tools

Static analysis tooling

CI integrations

Custom scanners

Job description

Skylight is seeking a security-focused product engineer to own the day-to-day execution of the product security program across cloud backend, mobile apps, and Android platform. You will triage vulnerabilities, run bug bounty, maintain AI-powered scanning, and partner with product and engineering on design reviews before new features ship.

You will work with the Head of Security, ship fixes when needed, and provide metrics to leadership.