Senior Staff Engineer, Product Security

Visit druva.com and follow us on LinkedIn, X and Facebook.

Experience Level: 6–10 Years
Domain: Product Security / AppSec / DevSecOps / AI Security / AI-First SDLC

We are looking for a hands-on Senior Staff Product Security Engineer to join and lead initiatives across our product security landscape. In this role, you will redefine modern Product Security by architecting an AI-first SDLC seamlessly integrating traditional AppSec with advanced AI security practices, automating shift-left pipelines, conducting rigorous threat models for core services and complex AI architectures, and leveraging cutting-edge AI tools to accelerate vulnerability remediation. You will partner directly with engineering leadership, Information Security, GRC, BuildOps, and DevOps teams to secure our SaaS products and safely enable cutting-edge agentic features.

• →AI-First SDLC & Shift-Left Automation: Architect and embed AI-driven security controls (SAST, DAST, SCA, Container, Secrets Detection) directly into CI/CD build pipelines and developer workflows, establishing an intelligent, highly automated AI-first SDLC.
• →Operational & Strategic AI Security: Leverage AI tooling operationally (e.g., auto-triage, threat-model drafting, fix generation) while strategizing security controls for product-facing AI features.
• →AI & Emerging Tech Threat Modeling: Assess risks specific to Generative and Agentic AI architectures, including MCP integrations, autonomous agents, tool-calling interfaces, multi-agent communication, prompt injections, and memory/context poisoning (OWASP Top 10 for LLMs / Agentic Apps).
• →Developer Guidance & Vulnerability Remediation: Review code (Python, Go, Javascript, etc), triage findings, and partner with engineering to implement robust short and long-term security fixes.
• →Supply Chain & Software Integrity: Manage third-party open-source risks, open-source dependency tracking, Software Bills of Materials (SBOMs), and secure MCP/agent server ecosystems.
• →Enablement & Champions Program: Conduct secure coding workshops, train developers on secure AI usage, and help grow an active Security Champions network.

• Experience: 6–10 years of product security engineering experience in a SaaS environment, with a proven track record of technical leadership.
• AppSec Fundamentals: Deep expertise in OWASP Top 10, CWE 25, threat modeling, cryptography, container security, and secure SDLC frameworks (SAMM, Microsoft SDL).
• AI Security & AI-First SDLC Expertise: Strong hands-on expertise with AI-first SDLC methodologies and reviewing AI security risks specifically around Agentic AI systems, MCP security (authorization, tool poisoning, confused deputy risks), and LLM security controls.
• Operational AI Use-Cases: Experience using AI tools to optimize security engineering workflows (e.g., automating root-cause analysis, threat modeling assistance, automated policy generation).
• Programming & Tooling: Proficient in code review and scripting with Python, Go, or Javascript (hands-on development experience is a major plus). Hands-on with tools like Burp Suite, Snyk, OWASP ZAP, and CI/CD security scanners.
• Education & Certifications: Bachelor’s degree in CS/IT or equivalent. Relevant certifications (OSCP, OSWE, CSSLP, GIAC) or active community contributions (OWASP, BSides, NullCon, Black Hat, etc) are a plus.