Product Security

What You Will Do

• Partner with product and engineering teams on architecture reviews, threat modeling, and secure design, translating complex security risks into practical recommendations and clear tradeoffs.
• Evaluate and roll out AI-assisted and agentic security workflows to increase security coverage and accelerate reviews, triage, and remediation, with appropriate validation and human oversight.
• Improve and maintain our first- and third-party security tooling, including our in-house ASPM platform, to reduce noise, improve prioritization, and make findings easier for engineering teams to act on.
• Strengthen security controls throughout the SDLC and CI/CD pipeline, including code and dependency scanning, software supply chain protections, and safeguards for AI-assisted development, without introducing unnecessary friction.
• Serve as a GCP security subject matter expert, advising engineering teams on secure patterns for networking, data protection, secrets management, workload runtimes, and logging and monitoring.
• Partner with infrastructure and engineering teams to implement least-privilege IAM, secure workload identities, and durable security guardrails through policy and infrastructure-as-code.
• Drive vulnerability management from triage through resolution: validate findings, assess risk, establish ownership, track remediation against SLAs, and document exceptions and risk acceptance.
• Coordinate penetration testing engagements, including vendor selection, scoping, testing logistics, findings validation, and remediation and retesting with engineering teams.
• Help shape and scale our product security program by identifying gaps, prioritizing improvements, and communicating risk, progress, and outcomes to security leadership.
• Enable engineers to make sound security decisions through practical documentation, reusable guidance, targeted training, and mentorship that keeps pace with how teams build and ship.

What We Are Looking For

• 5–7 years of experience in product security, cloud security engineering, software development or a related field.
• Practical experience applying AI and agentic workflows to accelerate security reviews, vulnerability triage, and remediation, with a strong understanding of the security risks associated with AI-assisted development.
• Strong knowledge of Google Cloud Platform (GCP) services and security best practices, including IAM, networking, data protection, and workload runtimes.
• Hands-on experience with penetration testing coordination, threat modeling, and risk assessment.
• Demonstrated proficiency in Python and cloud-native programming or scripting languages to design and maintain security automation, policy enforcement, and continuous compliance controls using Infrastructure as Code.
• Familiarity with designing and enforcing least-privilege IAM and conducting access reviews.
• Ability to communicate security risks and recommendations clearly to engineering and leadership audiences.