Role Overview :

The Principal Product Security Engineer is a senior technical leader responsible for safeguarding the security of products and services across the full Software Development Lifecycle (SDLC), with a strong emphasis on hands-on application penetration testing. This role combines deep offensive security expertise with architectural judgment, secure design guidance, and cross-organizational influence.

As a principal-level engineer, you will lead complex application security assessments across web applications, APIs, SaaS platforms, and emerging technologies (including AI-driven solutions), while also shaping product security strategy, standards, and engineering practices. You will work closely with R&D, Product Management, Cloud, SaaS, and QA teams to ensure security is built in, not bolted on.

This role is highly technical, execution-focused, and requires the ability to both find and exploit real-world vulnerabilities and drive durable remediation outcomes across multiple product lines.

Key Responsibilities :

Application Penetration Testing & Offensive Security :

- Lead and execute in-depth manual application penetration testing across web applications, APIs, and LLM/AI enabled applications.

- Perform security testing aligned with OWASP Top 10, OWASP API Top 10, OWASP LLM/AI Top 10, CWE Top 25, and emerging attack classes.

- Identify complex attack paths, chained vulnerabilities, and business-logic flaws beyond automated tool findings.

- Validate exploitability, determine real risk, and distinguish true positives from noise.

- Conduct secure code reviews to identify implementation flaws and support remediation.

- Retest fixes and mitigations to confirm effectiveness and risk reduction.

SDLC, DevSecOps & Tooling :

- Support security integration across the SDLC, including CI/CD pipelines and DevSecOps workflows.

- Support the use of SAST, DAST, SCA, secrets scanning, and container security tools.

- Support automation efforts to reduce time-to-detect and time-to-remediate.

- Partner with R&D teams to mature secure coding standards and shift-left practices.

Research & Continuous Improvement :

- Research evolving threats, attack techniques, and defensive strategies, including AI/LLM security risks.

- Stay current on emerging security tooling, frameworks, and industry best practices.

- Continuously improve testing methodologies, reporting quality, and remediation effectiveness.

Required Qualifications :

- Bachelors degree in computer science, Software Engineering, Cybersecurity, or equivalent practical experience.

- 7+ years of experience in Product Security, Application Security, or Software Security Engineering.

- Extensive hands-on experience conducting manual application penetration testing.

- Strong understanding of secure software development lifecycle (SSDLC) principles.

- Deep knowledge of OWASP Top 10, OWASP API Top 10, OWASP LLM/AI Top 10, CWE, CVSS, and vulnerability prioritization.

- Proficiency in at least one programming language such as Python, Java, JavaScript/TypeScript, Go, or C/C++.

- Experience with modern application architectures, APIs, and cloud-based systems.

- Ability to clearly communicate security findings and remediation guidance to both technical and non-technical stakeholders.

- Experience integrating security controls into CI/CD pipelines.

Preferred / Nice-to-Have Qualifications :

- Relevant certifications such as OSCP, GWAPT, OSWE, GPEN, CISSP, CSSLP, or CCSP.