Product Security Engineer - Threat Modelling

Company : Quest Global

Location : Bengaluru, Karnataka

Job Summary :

We are looking for an experienced Product Security Engineer specialising in Threat Modelling and Security Architecture to strengthen product security throughout the development lifecycle.

The candidate will be responsible for identifying potential security threats, conducting threat modelling exercises, evaluating product architectures and recommending security controls to ensure secure-by-design product development.

Key Responsibilities :

- Perform Threat Modelling using STRIDE, PASTA, MITRE ATT&CK and other industry-standard methodologies.

- Conduct security architecture reviews and identify potential design-level vulnerabilities.

- Identify attack surfaces, threat scenarios, security gaps and potential risks.

- Recommend Secure-by-Design solutions and appropriate security controls.

- Define product security requirements during the design and development stages.

- Conduct product security risk assessments and vulnerability analysis.

- Collaborate with software architects, development teams and product stakeholders to address identified threats.

- Evaluate security risks in cloud-native, distributed and legacy product architectures.

- Provide guidance on cryptography, IAM, network security and secure communication protocols.

- Identify compensating controls and mitigation strategies for product security risks.

- Support Product Security governance, security reviews and roadmap planning.

Required Skills & Qualifications :

- 6 - 9 years of experience in Product Security, Security Architecture or Application Security.

- Strong hands-on experience in Threat Modelling methodologies such as STRIDE, PASTA and MITRE ATT&CK.

- Experience conducting Security Architecture Reviews.

- Strong understanding of Secure-by-Design principles.

- Experience identifying attack vectors, threat scenarios and security vulnerabilities.

- Knowledge of security risk assessment and mitigation strategies.

- Understanding of cryptography, IAM, network security and secure communication protocols.

- Experience working closely with software architects and engineering teams.

- Knowledge of SSDLC and product security governance.