Senior Product Security Engineer – Secure SDLC & PenTesting

Tessera Labs; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Tessera Labs in the United States is seeking a Senior Product Security Engineer to partner with developers to secure the product across its lifecycle. You’ll influence design, perform threat modeling, and conduct hands-on penetration testing to make the platform defensible.

You will collaborate with product and platform engineering teams to embed security into the SDLC, lead security reviews, and help define secure coding standards while enabling engineers to ship securely.

Qualifications

• Proven track record in product or application security.
• Hands-on pentesting against web apps and APIs.
• Deep understanding of modern web apps, OAuth 2.0 / OpenID Connect, OWASP Top 10.
• Experience running security design reviews and threat modeling.
• Solid SDLC understanding with security embedded in processes.
• Strong communication with developers about risk and remediation.

Responsibilities

• Secure SDLC integration and lead design reviews.
• Lead threat modeling on new features and services.
• Perform hands-on pentesting of web apps and APIs.
• Conduct secure code reviews and define secure coding standards.
• Operate SAST/DAST and dependency/container scanning.
• Explain findings to engineers to prevent recurrence.
• Contribute to SOC 2/ISO 27001 and related compliance evidence.

Skills

Penetration testing

Threat modeling

Security design reviews

OAuth 2.0 / OpenID Connect

SDLC security

Clear communication

Tools

OWASP ZAP

Burp Suite

Semgrep

Trivy

Grype

Nuclei

Job description

Tessera Labs in the United States is seeking a Senior Product Security Engineer to partner with developers to secure the product across its lifecycle. You’ll influence design, perform threat modeling, and conduct hands-on penetration testing to make the platform defensible.

You will collaborate with product and platform engineering teams to embed security into the SDLC, lead security reviews, and help define secure coding standards while enabling engineers to ship securely.