Staff Security Engineer, Product Security

The Staff Security Engineer, Product Security will shape security architecture and engineering practices across a broad portfolio of products, services, and global infrastructure. This senior technical role combines hands-on security engineering with organization-wide architectural influence, ensuring that secure-by-default principles are embedded throughout product development. You will establish scalable security patterns, lead reviews of high-risk features, and guide engineering teams through complex design and threat-modeling decisions. Beyond individual security assessments, you will build programs, tools, and services that extend security expertise across hundreds of engineers. Working closely with platform, infrastructure, and product engineering teams, you will address systemic vulnerabilities and strengthen security throughout the software development lifecycle. You will also mentor engineers, lead multi-team initiatives, and serve as a trusted technical authority on product security.

• Typically 8+ years of experience in product security, application security, or a related field, including substantial hands-on experience building security tools and services rather than focusing exclusively on reviews. Demonstrated capabilities and work are valued more than an exact number of years.

• Proven track record designing security architecture that scales across multiple teams, products, and services, rather than securing only an individual application.

• Strong understanding of web application security principles and practical experience using application security testing tools such as Burp Suite, OWASP ZAP, or similar solutions.

• Software development experience building security tools and services in at least one modern programming language, such as Go, Python, Java/Kotlin, TypeScript, or Ruby.

• Demonstrated ability to lead complex technical initiatives involving multiple engineering teams and drive adoption of shared security standards.

• Experience mentoring engineers and supporting their progression into senior technical roles.

• Strong architectural judgment and threat-modeling capabilities, with the ability to identify security risks and work collaboratively with engineering teams on practical solutions.

• Excellent communication and collaboration skills, including the ability to influence technical decisions across teams and explain security concepts to varied stakeholders.

Nice to Have

• Experience establishing, managing, or scaling a security champions program.

• Knowledge of identity management and identity federation technologies, including SAML, OAuth, and SCIM.

• Experience with IaaS cloud infrastructure, Kubernetes, container technologies, and service-oriented architectures.

• Hands-on experience with bug bounty platforms and Static Application Security Testing (SAST) tools such as Cycode, Semgrep, Snyk, or similar.

• Experience conducting code audits of internal or open-source libraries before they are released into production.