Staff Product Security Engineer - Hands-on Threat Modeling

Hw3 Llc; San Mateo (CA); On-site; USD 150,000 - 210,000; Full time

Job summary

HW3 is hiring a Staff Security Engineer focused on product security in San Mateo. You will work closely with software engineers, shaping security decisions early in development and writing production code when needed.

The role centers on securing customer-facing software across web and mobile, including auth, permissions, auditability, and data protection. You will lead threat modeling, architecture reviews, and security code reviews while building security tooling and driving secure development

Qualifications

• 7+ years of security engineering experience in product teams.
• Software engineering background with production‑level coding skills.
• Strong product/application security and threat modeling experience.
• Experience reviewing cloud-based apps and infra (AWS/GCP).
• Clear communicator who can influence engineering decisions while hands-on.

Responsibilities

• Partner with product and engineering teams to identify and address security risks as they design and build new features.
• Lead threat modeling, architecture reviews, technical design reviews, and security code reviews.
• Help engineers implement practical fixes and improve security defaults and development practices.
• Build or improve security tooling and automation, contributing production code where needed.
• Assess vulnerabilities and external security findings, then work with engineering teams to prioritize remediation.
• Coach engineers and help set product security priorities across teams.

Skills

Security engineering

Software development

Cloud security

Threat modeling

Security reviews

Tools

AWS

GCP

Job description

HW3 is hiring a Staff Security Engineer focused on product security in San Mateo. You will work closely with software engineers, shaping security decisions early in development and writing production code when needed.

The role centers on securing customer-facing software across web and mobile, including auth, permissions, auditability, and data protection. You will lead threat modeling, architecture reviews, and security code reviews while building security tooling and driving secure development