Role Overview :

We are looking for a Senior Product Security Engineer to secure enterprise applications and AI-powered products across multiple engineering teams and repositories.

This role requires strong hands-on security expertise, the ability to operate at scale, and the ability to quickly identify, prioritize, and drive remediation of security risks across multiple products.

Key Responsibilities :

- Own security assessments across multiple enterprise applications, products, repositories, and engineering teams.

- Perform hands-on Web, API, cloud, and Kubernetes security testing, including vulnerability discovery, exploitation, validation, and reporting.

- Identify vulnerabilities through manual testing, source-code review, threat modeling, and security tooling.

- Assess authentication, authorization, business logic, APIs, attack surfaces, cloud configurations, IAM, containers, and Kubernetes environments.

- Identify and prioritize vulnerabilities based on exploitability, business impact, and risk.

- Work directly with engineering teams to drive remediation, retesting, and closure of security findings.

- Integrate security into the SDLC and CI/CD pipelines through SAST, DAST, SCA, secrets detection, and security gates.

- Establish repeatable and scalable security practices that can be applied across multiple products and teams.

- Rapidly assess new applications and prioritize the highest-risk security gaps in fast-moving development environments.

- Communicate technical vulnerabilities, business impact, and remediation requirements clearly to both engineering and business stakeholders.

Qualifications:

- Hands-on experience in Product Security, Application Security, or Security Engineering.

- Proven experience securing multiple enterprise applications/products across multiple repositories and engineering teams.

- Strong hands-on expertise in Web and API Security, OWASP Top 10, and vulnerability assessment.

- Demonstrated ability to discover and validate real-world vulnerabilities, beyond relying only on automated scanners.

- Strong experience with Burp Suite/ZAP, source-code security review, and root-cause analysis.

- Experience securing cloud environments, Kubernetes/GKE, IAM, containers, and CI/CD pipelines.

- Experience implementing or operating SAST, DAST, and SCA within the SDLC.

- Proven ability to prioritize and remediate security risks across multiple applications simultaneously.

- Experience working directly with engineering teams to drive vulnerabilities from discovery through remediation and retesting.

- Demonstrated ability to operate with speed, ownership, and strong execution in large-scale engineering environments.

- Strong communication skills with the ability to translate technical security issues into business risk and actionable remediation.

Nice to Have :

- GCP/GKE experience

- AI/GenAI application security

- OSCP, OSWE, GIAC, CREST, or equivalent