Staff Product Security Engineer

SailPoint; United States; Remote; USD 145,000 - 245,000; Full time

Benefits offered by this job

Health and wellness coverage: Medical,

Dental and vision insurance

Disability coverage: Short-term and LT

Life insurance and AD&D

401(k) with company match

Flexible vacation policy

8 paid holidays annually

Parental leave

Job summary

SailPoint is seeking a Product Security Engineer to partner with engineering teams across the SDLC to identify and mitigate security risks and embed secure-by-design practices. You will drive threat modeling, secure coding standards, and risk-based remediation while collaborating with EPS and CPS teams.

The role emphasizes AI-assisted security tooling, scalable remediation workflows, and security training to enable product teams. Remote within the continental US; competitive base compensation.

Qualifications

• 4-5 years of experience in product security, application security, software engineering, or a related field.
• Experience with security testing tools such as SAST, SCA, DAST, Container security scanners.
• Experience with CI/CD security controls and DevSecOps practices.
• Familiarity with programming languages such as Python, Go, Java, JavaScript/TypeScript, Ruby.
• Demonstrated ability to effectively use AI-powered tools and automation to enhance security engineering productivity, research, analysis, and remediation efforts.
• Knowledge of emerging AI security risks and best practices for securing AI-enabled applications, services, and development workflows.
• Deep expertise in threat modeling, secure architecture design, and vulnerability management.
• Experience influencing engineering organizations and driving security initiatives across multiple teams.
• Knowledge of AI security frameworks is strongly preferred (OWASP AI Security and Privacy Guide, NIST AI RMF, CAI, Open SSF AI/ML Security Framework).

Responsibilities

• Partner with Engineering teams throughout the software development lifecycle to identify and mitigate security risks, and implement secure deployment practices.
• Support threat modeling activities and help engineering teams implement appropriate security controls.
• Define and promote secure coding standards, security policies, best practices, and secure-by-design principles.
• Participate in the Cyber organization’s efforts to leverage AI across the team, as well as the use of AI in our SSDLC.
• Partner with Engineering on improving security testing programs.
• Coordinate internal and external application and penetration testing initiatives.
• Validate vulnerability findings and prioritize remediation based on risk.
• Perform root cause analysis and recommend long-term security improvements.
• Collaborate with the Security Operations team on security monitoring and detection capabilities for applications and services.
• Triage, coordinate, and oversee remediation for security researcher disclosures via our bug bounty program.
• Develop security training, guidance, and technical documentation.
• Interact with other organizations at SailPoint as a consultant on security-related matters.

Skills

SAST

SCA

DAST

Container security

DevSecOps

Python

Go

Java

JavaScript/TypeScript

Ruby

AI-powered tools

Threat modeling

Secure architecture

Vulnerability management

Security influence

Tools

CI/CD tooling

Kubernetes

Job description

Product Security Engineer Overview

Product Security Engineer Overview SailPoint’s Cybersecurity organization is seeking a Product Security Engineer with a passion for cybersecurity and protecting the organization. The ideal candidate combines strong application security expertise with practical software engineering experience and can effectively influence to build secure, resilient products at scale. This position reports to the Director of Cyber Product Security (CPS) and the successful candidate will join a team of security engineers who collaborate with stakeholders across the organization. This role will partner closely with Engineering and the other security teams within the Cyber organization to identify security risks, drive remediation efforts, and embed security throughout the product development process. Central to SailPoint’s product security program is the implementation of a shared security model that impacts all software developed by SailPoint. Under this model, CPS is responsible for multiple key areas affecting product security and collaborates with SailPoint's Engineering Product Security (EPS) team on areas of mutual responsibility. The shared responsibility model was developed to shift product security left, moving security checks to the earliest phases of our secure software development lifecycle. The product security engineer will have the opportunity to shape our future through process and technology optimization, capability acquisition and development, and maturation of our existing activities. They’ll already be comfortable with the 4 I’s at SailPoint (individual, Impact, Innovation, and Integrity) even if they’re new to the concept. They will embrace new challenges and will be a positive contributor to an already positive work culture and environment. Location is remote with the ability to work from anywhere within the continental United States.

Key Responsibilities

• Partner with Engineering teams throughout the software development lifecycle to identify and mitigate security risks, and implement secure deployment practices
• Support threat modeling activities and help engineering teams implement appropriate security controls
• Define and promote secure coding standards, security policies, best practices, and secure-by-design principles
• Participate in the Cyber organization’s efforts to leverage AI across the team, as well as the use of AI in our SSDLC
• Partner with Engineering on improving security testing programs
• Coordinate internal and external application and penetration testing initiatives
• Validate vulnerability findings and prioritize remediation based on risk
• Perform root cause analysis and recommend long-term security improvements
• Collaborate with the Security Operations team on security monitoring and detection capabilities for applications and services
• Triage, coordinate, and oversee remediation for security researcher disclosures via our bug bounty program
• Develop security training, guidance, and technical documentation
• Interact with other organizations at SailPoint as a consultant on security-related matters

Required Qualifications

• 4-5 years of experience in product security, application security, software engineering, or a related field
• Experience with security testing tools such as: SAST, SCA, DAST, Container security scanners
• Experience with CI/CD security controls and DevSecOps practices
• Familiarity with one or more programming languages such as Python, Go, Java, JavaScript/TypeScript, Ruby
• Demonstrated ability to effectively use AI-powered tools and automation to enhance security engineering productivity, research, analysis, and remediation efforts
• Knowledge of emerging AI security risks and best practices for securing AI-enabled applications, services, and development workflows
• Deep expertise in threat modeling, secure architecture design, and vulnerability management
• Experience influencing engineering organizations and driving security initiatives across multiple teams
• Knowledge of artificial intelligence software security frameworks is strongly preferred, including OWASP AI Security and Privacy Guide, NIST AI Risk Management Framework, Cybersecurity AI (CAI), Open SSF AI/ML Security Framework.

Core Competencies

• Be a highly active observer of industry security trends and threats, remaining up to date on current cyber issues
• Have a continuous learning mindset and passion for security
• Have strong analytical and problem-solving skills
• Be flexible, with the ability to balance security vs the needs of the business
• Have excellent written and oral communications skills with demonstrated commitment to producing high quality documentation
• Be able to translate technical risks into business impact
• Be collaborative and able to foster relationships with teams we partner with

First 90 Days

Discovery, Strategic Alignment, and Partnership

Strategic Alignment & Planning

• Integration: Deepen collaboration with key engineering and tooling leads by Day 90, reinforcing recurring touchpoints to integrate product security proactively into early planning cycles, roadmaps, and feature designs.
• SDLC Optimization Assessment: Review the end-to-end Software Development Life Cycle (SDLC) by Day 60 to identify enhancement opportunities, accelerate "shift-left" practices, and further standardize secure-by-design deployment pipelines.
• Asset & Dependency Inventory: Refine and centralize the inventory of supported products, underlying architecture, and third‑party dependencies by Day 90 to deliver a highly visible, comprehensive single source of truth.

First 6 Months

Advanced Tooling, Training, and Scalable Frameworks

• Modernizing Tool Stack & AI Integration: Evaluate the current security tooling and implement state-of-the-art AI-assisted scanning across product code to further automate and scale security workflows.
• Optimized Remediation & Board Metrics: Formalize a highly scalable, risk-based vulnerability prioritization framework, optimizing Time to Remediate (TTR) metrics to provide clear, actionable risk visibility for executive leadership and the Board.
• Security Champions & Developer Empowerment: Elevate developer security education and revamp "Security Champions" program by Day 180, embedding security advocates across core product lines to champion secure development practices.

First 12 Months

Systemic Security Advancements and "Paved Roads"

• Systemic Architecture Enhancements: Conduct comprehensive reviews of the production environment (including Kubernetes and containerized applications) to systematically address complex architectural security opportunities and build long-term environment resilience.
• Standardizing "Paved Road" Configurations: Define, document, and roll out standardized, secure "paved road" configurations and guardrails, making secure deployment the friction-free path of least resistance for product teams.
• Program Scaling & Mentorship: Maintain and scale updated product architecture documentation while continuously elevating team capabilities, autonomy, and cross-functional alignment through active, hands-on mentorship.

Benefits and Compensation listed vary based on the location of your employment and the nature of your employment with SailPoint.

As a part of the total compensation package, this role may be eligible for the SailPoint Corporate Bonus Plan or a role-specific commission, along with potential eligibility for equity participation. SailPoint maintains broad salary ranges for its roles to account for variations in knowledge, skills, experience, market conditions and locations, as well as reflect SailPoint’s differing products, industries, and lines of business. Candidates are typically placed into the range based on the preceding factors as well as internal peer equity. We estimate the base salary, for US-based employees, will be in this range from (min-max, USD): $145,300 - $244,850.00. Base salaries for employees based in other locations are competitive for the employee’s home location.

Benefits Overview

• 1. Health and wellness coverage: Medical, dental, and vision insurance
• 2. Disability coverage: Short-term and long-term disability
• 3. Life protection: Life insurance and Accidental Death & Dismemberment (AD&D)
• 4. Additional life coverage options: Supplemental life insurance for employees, spouses, and children
• 5. Flexible spending accounts for health care, and dependent care; limited purpose flexible spending account
• 6. Financial security: 401(k) Savings and Investment Plan with company matching
• 7. Time off benefits: Flexible vacation policy
• 8. Holidays: 8 paid holidays annually
• 9. Sick leave
• 10. Parental support: Paid parental leave
• 11. Employee Assistance Program (EAP) and Care Counselors
• 12. Voluntary benefits: Legal Assistance, Critical Illness, Accident, Hospital Indemnity and Pet Insurance options
• 13. Health Savings Account (HSA) with employer contribution

SailPoint is an equal opportunity employer and we welcome all qualified candidates to join our team. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other category protected by applicable law.

SailPoint (Nasdaq: SAIL) is defining the new era of adaptive identity security. In a world where non-human identities now significantly outnumber humans, our AI-powered platform unifies identity, security, and data intelligence to protect today’s enterprise from advanced identity-based threats. We deliver the identity solution that spans both the breadth of identities and the depth of context needed to drive real-time access with confidence. Built on principles like zero-standing privilege and contextualized risk, our SailPoint platform transforms identity from a point of vulnerability into a powerful security advantage. Trusted by many of the world’s leading organizations, SailPoint secures the enterprise with intelligent, autonomous identity security.

The employment policy of SailPoint is to provide equal opportunity to all persons, and it is SailPoint’s policy to take affirmative action to employ and advance in employment protected veterans and individuals with disabilities. It is SailPoint’s policy to recruit, hire, train and promote qualified individuals in all job titles, and ensure that all other personnel actions are administered without regard to race, color, religion, national origin, sex, military and/or veteran status, disability, or other legally protected status, and we will ensure that all employment decisions are based only on valid job requirements. SailPoint does not discriminate on the basis of national origin or citizenship status as provided under the Immigration Reform and Control Act of 1986. Employees and applicants shall not be subjected to harassment, intimidation, threats, coercion, or discrimination because they have engaged in or may engage in any of the following activities: Filing a complaint; Assisting or participating in an investigation, compliance evaluation, hearing, or any other activity related to the administration of the affirmative action provisions of Section 503, VEVRAA, or any other Federal, State or local law requiring equal opportunity for individuals with disabilities or protected veterans; Opposing any act or practice made unlawful by Section 503, VEVRAA, or their implementing regulations in this part, or any other Federal, State or local law requiring equal opportunity for individuals with disabilities or protected veterans; or Exercising any other right protected by section 503, VEVRAA or their implementing regulations. SailPoint will also provide reasonable accommodation to known physical or mental limitations of an otherwise qualified employee or applicant for employment, unless the accommodation would impose undue hardship on the operation of our business. SailPoint’s affirmative action program contains an audit and reporting system which enables us to measure the effectiveness of our program, indicate any need for remedial action, determine the degree to which our objectives have been attained, determine whether protected veterans and individuals with disabilities had had the opportunity to participate in company-sponsored activities, measure our compliance with the program’s specific obligations, and document actions taken to comply with these obligations.