Staff Product Security Engineer

Hw3 Llc; San Mateo (CA); On-site; USD 150,000 - 210,000; Full time

Job summary

HW3 is hiring a Staff Security Engineer focused on product security in San Mateo. You will work closely with software engineers, shaping security decisions early in development and writing production code when needed.

The role centers on securing customer-facing software across web and mobile, including auth, permissions, auditability, and data protection. You will lead threat modeling, architecture reviews, and security code reviews while building security tooling and driving secure development

Qualifications

• 7+ years of security engineering experience in product teams.
• Software engineering background with production‑level coding skills.
• Strong product/application security and threat modeling experience.
• Experience reviewing cloud-based apps and infra (AWS/GCP).
• Clear communicator who can influence engineering decisions while hands-on.

Responsibilities

• Partner with product and engineering teams to identify and address security risks as they design and build new features.
• Lead threat modeling, architecture reviews, technical design reviews, and security code reviews.
• Help engineers implement practical fixes and improve security defaults and development practices.
• Build or improve security tooling and automation, contributing production code where needed.
• Assess vulnerabilities and external security findings, then work with engineering teams to prioritize remediation.
• Coach engineers and help set product security priorities across teams.

Skills

Security engineering

Software development

Cloud security

Threat modeling

Security reviews

Tools

AWS

GCP

Job description

Staff Security Engineer, Product Security

HW3 is partnering with a technology company to hire a Staff Security Engineer focused on product security. This is a hands‑on role for someone who can work closely with software engineers, shape security decisions early in development, and write code when a problem calls for it.

You’ll focus on the security of a customer‑facing software platform, including authentication, authorization, user permissions, auditability, and protection of customer data across web and mobile applications.

What you’ll do

• Partner with product and engineering teams to identify and address security risks as they design and build new features.
• Lead threat modeling, architecture reviews, technical design reviews, and security code reviews.
• Help engineers implement practical fixes and improve security defaults and development practices.
• Build or improve security tooling and automation, contributing production code where needed.
• Assess vulnerabilities and external security findings, then work with engineering teams to prioritize remediation.
• Coach engineers and help set product security priorities across teams.

What we’re looking for

• At least 7 years of relevant security engineering experience, including close partnership with software engineering teams.
• A software engineering background and the ability to write and review production code.
• Strong experience with product or application security, secure development practices, and threat modeling.
• Experience reviewing cloud‑based applications and infrastructure in AWS, GCP, or a similar environment.
• A solid understanding of common application weaknesses, how they can be exploited, and how to mitigate them.
• Clear communication, sound judgment, and the ability to influence engineering decisions while remaining hands‑on.

This role is based in San Mateo and currently requires at least four days per week with the preference for 5.