Staff Application & Product Security Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Application & Product Security Engineer based in United States.

This Staff-level individual contributor role owns application and product security across both SaaS and customer-hosted products.
You will shape how security is embedded throughout the software development lifecycle, from architecture and threat modeling through release and remediation.
The role combines hands-on engineering with program ownership, allowing you to establish standards, build automated guardrails, and influence security decisions across engineering teams.
You will partner closely with Engineering, Product, Architecture, Cloud Security, and executive leadership to strengthen the security posture of shipped products.
A major focus will be vulnerability management, secure development practices, customer-facing product security, and security enablement for developers.
You will also lead emerging AI security efforts, establishing practical controls for LLM-enabled features, AI agents, and AI-assisted development workflows.
This is an opportunity to make high-impact technical decisions while creating scalable security programs, automation, and processes that support a growing product organization.

Accountabilities:

• Own and continuously mature the secure software development lifecycle, including security requirements, threat modeling, design reviews, and security controls for high-risk product changes, APIs, and integrations.
• Run and optimize SAST, SCA, secrets detection, container, and infrastructure-as-code scanning across development and CI/CD environments.
• Build reusable secure patterns, reference implementations, and policy-as-code controls that make secure development practices easier for engineering teams to adopt.
• Lead developer security enablement through Security Champions programs, training campaigns, remediation guidance, office hours, and self-service security capabilities.
• Manage application and product vulnerabilities through risk-based triage, remediation SLAs, escalations, exceptions, exploit reproduction, patch validation, and release verification.
• Own the penetration testing program, including scoping third-party engagements, performing targeted testing, coordinating remediation, and validating findings through retesting.
• Manage the Vulnerability Disclosure Program and coordinate communications with external researchers, customers, and other stakeholders through coordinated disclosure processes.
• Coordinate the CVE lifecycle for products and support product-security incident response activities.
• Own application and product-security controls within the NIST CSF 2.0 program, tracking maturity, closing gaps, and producing audit evidence.
• Establish and maintain the security posture of products across SaaS and customer-hosted environments, including secure defaults, authentication, session controls, RBAC, tenant isolation, administrative access, configuration security, and hardening guidance.
• Own the Product Security Roadmap in partnership with Product Management, Technology leadership, and Architecture, ensuring priority security capabilities are incorporated into product development.
• Serve as the technical owner for customer-facing product security, including reviewing vulnerability scans and penetration-test reports, responding to security RFIs and enhancement requests, and preparing security advisories, release notes, and hardening documentation.
• Lead threat modeling and security reviews for LLM-enabled product features, AI agents, and AI-assisted development workflows.
• Develop security controls and secure patterns addressing prompt injection, sensitive data exposure, insecure output handling, excessive agency, insecure tool integrations, and AI supply-chain risks.
• Apply and operationalize relevant AI security frameworks and guidance, including the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework.

Requirements:

• 6+ years of experience in application security, product security, or secure software engineering, including experience building or maturing an AppSec program across multiple engineering teams.
• Strong software development capabilities in an object-oriented programming language, with Java experience preferred; ability to read, debug, and write production-quality code and work across languages such as TypeScript, Python, or Go.
• Deep understanding of modern application attack surfaces, including authentication, authorization, API security, business-logic vulnerabilities, and contemporary service architectures.
• Hands-on experience integrating and tuning SAST, SCA, and secrets scanning within GitHub and CI/CD pipelines.
• Demonstrated ability to reproduce security exploits against running applications, validate patches, and translate technical findings into actionable guidance for both researchers and customers.
• Experience coordinating vulnerability disclosure with external security researchers and customers, including managing disclosure timelines and driving CVEs through publication.
• Experience securing shipped software with an established customer base, including secure defaults, hardening guidance, customer advisories, security release notes, and responses to customer scan reports or security RFIs.
• Practical experience with threat modeling, architecture and design reviews, manual security testing, and direct collaboration with developers throughout remediation.
• Strong communication skills and the ability to translate complex technical risks into clear engineering guidance for developers and concise risk assessments for executives.
• Confidence making and defending release-gating security decisions when risk levels warrant escalation.
• Experience with AI application security, AI agents, or AI-assisted development tools is preferred.
• Familiarity with SBOM standards such as CycloneDX or SPDX, VEX, artifact signing, and SLSA is a plus.
• Experience with AWS, Kubernetes/EKS, Terraform, or Jenkins is beneficial.
• Familiarity with security tools such as Snyk, GitHub Advanced Security, Semgrep, and Burp Suite is preferred.
• Knowledge of NIST CSF 2.0, OWASP SAMM/ASVS, NIST SSDF, and security audit frameworks such as SOC 2 or ISO 27001 is advantageous.
• Security certifications such as CSSLP, OSWE, GWAPT, AWS Security, or comparable credentials are a plus.
• Experience with enterprise software supporting both SaaS and customer-hosted deployment models, including SSO/SAML, RBAC, multi-tenant isolation, MFT/EDI, or other B2B integration products, is beneficial.

Benefits:

• $160,000–$180,000 base compensation plus bonus opportunity.
• Healthcare, dental, and vision coverage.
• Flexible paid time off.
• Culture focused on support and sustainable work-life balance.
• 401(k) with company match.
• Flexible Spending Account (FSA) and Health Savings Account (HSA) options.
• Employee Assistance Program.
• Paid parental leave.
• Remote work environment.
• Opportunity to contribute to products serving more than 4,000 clients with a 99% retention rate.
• Accelerated opportunities for title and salary growth.
• Energetic and collaborative work environment.

How Jobgether works:

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1