Senior Product Security Engineer
for headings. Use - for lists. Use
for prose. Do NOT repeat job title as heading. Do NOT include Job ID etc. Remove boilerplate. Include only sections with real content.
We need to parse the posting.
Key content:
- Intro: "Joining Collibra’s Product Security team Collibra is seeking a Senior Product Security Engineer to join our high-impact team. You will be a key individual responsible for identifying vulnerabilities and providing expert remediation consulting for our global product development teams. This role provides critical technical leadership and oversight, ensuring Collibra continues to deliver secure, resilient products and services to our customers. You will act as an application security evangelist, partnering with engineers to accelerate secure time-to-value while leveraging cutting-edge AI and MCP to create context-aware security automation."
That's about the role.
Then bullet list: "Product Security Engineers at Collibra are responsible for" then list items:
- Application Penetration Testing (Web-app, API, Thick Client)
- Network Penetration Testing (Internal, External)
- Cloud Service penetration testing tradecraft and methodologies across multiple service providers (AWS, Azure, GCP)
- Threat Modeling
- Source-Code Reviews
- Ensure quality reports and services are delivered efficiently and on time
- Collaborate with cross-functional teams to ensure that security best practices are integrated into the development process
- Enable remediation of discovered vulnerabilities through the building of relationships with engineering teams
- Continue to develop professional skills with relevant industry specific certifications or training
- Assist with triaging Code Security findings identified by SAST, SCA, IAST, DAST, where necessary.
- Leverage AI and MCP to create intelligent, context-aware security guidance and automation.
Then "You have" list of requirements/experience:
- 5+ years of relevant Penetration Testing, Product Security, and Application Security experience.
- 2+ years securing Java, Python, and/or JavaScript web applications.
- Experience with advanced security tools and techniques for simulating real-world attacks.
- Familiarity with Open-Source Security Testing Methodology Manual (OSSTMM), Open Web Application Security Project (OWASP), Software Assurance Maturity Model (SAMM), National Institute of Standards and Technology (NIST) Special Publications, and PTES (Penetration Testing Execution Standard).
- Experience testing against compliance frameworks such as PCI, FISMA, HIPAA, FedRAMP, or HITRUST.
- Strong working knowledge of at least two programming or scripting languages.
- Familiarity with best practices for securing the SDLC and DevOps processes.
- Ability to triage security incidents when needed.
- Experience with AI security tooling and context-aware SSDLC automation.
- Understanding of AI privacy and governance in developer workflows.
- Experience using and building collaborative agentic AI systems.
- Demonstrated proficiency in leveraging AI tools (e.g., Claude, Gemini, ChatGPT, Copilot) to solve real-world business challenges, drive measurable outcomes, or streamline workflows.
- A Bachelor’s degree or equivalent certification and experience.
- Demonstrated proficiency in leveraging AI tools (e.g., Claude, Gemini, ChatGPT, Copilot) to solve real-world business challenges, drive measurable outcomes, or streamline workflows. (duplicate)
- A bachelor’s degree or equivalent related working experience is required (duplicate)
- This position is not eligible for visa sponsorship (metadata, maybe drop)
- You are (list of traits):
- Grounded in security principles, policies, and industry best practices.
- An excellent verbal and written communicator, able to produce assessment reports, presentations, and operating procedures.
- A developing or established leader who matures security practices and mentors junior teammates.
- An advocate for the remediation of application security risk and, simultaneously, the associated development/engineering teams.
Then "Preferred Experience" list:
- Relevant security certifications strongly preferred (e.g. OSCP, OSWE, CRTP)
- Red/Purple team operations
- Possess a working knowledge of Python, Java, and/or JavaScript software development languages
- Experienced in performing security assessments against containerized cloud environments.
- Familiarity with AI standards and regulations, EU AI Act, SAIF and ISO 42001.
Then "Measures of success" bullet list:
- Within your first month, you will build foundational knowledge of Collibra’s processes, tools, and SDLC. You will use that knowledge to design and implement repeatable penetration-testing methodologies tailored to the environment.
- Within your first three months, you will independently plan and execute penetration-testing engagements, then partner with development teams to understand, prioritize, and remediate identified security issues.
- Within your first six months, you will partner with your leader to develop a security roadmap for comprehensive, proactive assessments across Collibra. You will incorporate threat intelligence to anticipate emerging threats and identify potential security gaps.
Then "Compensation for this role" paragraph:
- The standard base salary range for this position is $168,000.00 - $210,000.00 per year. This position is not eligible for additional commission-based compensation. Salary offers are based on a combination of factors, including, but not limited to, experience, skills, and location. In addition to base salary, we offer a competitive total rewards package, including bonus potential, equity for eligible roles, a Flex Fund monthly stipend, pension/401k plans, and more.
Then "Benefits at Collibra" paragraph:
- Collibra recognizes and values that everyone has different needs, interests, and life goals. We built our benefits program with flexibility in mind to support you and your loved ones through a diverse range of circumstances and life events. These flexible offerings sit on a foundation of competitive compensation, health coverage, and time off. Learn more about Collibra’s benefits.
Then inclusion and belonging paragraph, EEO etc. Those are boilerplate; we should remove EEO/equal-opportunity etc. The instructions: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we should drop the inclusion paragraph and EEO statement.
Thus we have sections:
- About the role (intro paragraph)
- Responsibilities (list of duties)
- Requirements (maybe combine required experience and qualifications)
- Qualifications (maybe education)
- Skills (maybe technical skills)
- Benefits (benefits paragraph)
- Pay (compensation paragraph)
- Schedule? Not mentioned. So we should not create Schedule section.
We need to decide which headings to include. The instruction: "Prefer a few substantive sections over many thin ones." So we can combine similar items.
Potential sections:
- About the role (intro)
- Responsibilities (list)
- Requirements and Qualifications (combined)
- Skills (maybe technical skills)
- Benefits
- Pay
But we need to avoid duplication. Let's extract distinct content.
Responsibilities list: the bullet list after "Product Security Engineers at Collibra are responsible for". That's responsibilities.
Requirements: the "You have" list (experience, years, etc.) plus maybe "You are" traits (soft skills). Could be considered requirements.
Qualifications: education (Bachelor's degree or equivalent). Could be part of requirements.
Skills: technical skills like programming languages, tools, AI, etc. Could be separate.
But we can combine Requirements and Qualifications into one section "Requirements". Or we can have "Requirements" and "Qualifications" separate if there is distinct content.
Let's see distinct content:
- Experience: 5+ years relevant Penetration Testing, Product Security, Application Security.
- 2+ years securing Java, Python, and/or JavaScript web applications.
- Experience with advanced security tools and techniques for simulating real-world attacks.
- Familiarity with OSSTMM, OWASP, SAMM, NIST, PTES.
- Experience testing against compliance frameworks PCI, FISMA, HIPAA, FedRAMP, HITRUST.
- Strong working knowledge of at least two programming or scripting languages.
- Familiarity with best practices for securing the SDLC and DevOps processes.
- Ability to triage security incidents when needed.
- Experience with AI security tooling and context-aware SSDLC automation.
- Understanding of AI privacy and governance in developer workflows.
- Experience using and building collaborative agentic AI systems.
- Demonstrated proficiency in leveraging AI tools (Claude, Gemini, ChatGPT, Copilot) to solve real-world business challenges, drive measurable outcomes, or streamline workflows.
- Bachelor’s degree or equivalent certification and experience.
- This position is not eligible for visa sponsorship (metadata, drop)
- You are traits: grounded in security principles, excellent communicator, developing/established leader, advocate for remediation.
Preferred Experience: list of preferred certifications, red/purple team, working knowledge of Python/Java/JS, containerized cloud assessments, familiarity with AI standards/regulations.
Measures of success: could be considered responsibilities or expectations; maybe we can include under Responsibilities or a separate section "Success Metrics". But instruction: include a section ONLY when posting has real, specific content for it. Measures of success is specific content. Could be a section "Success Metrics" but not in the allowed headings list? The allowed headings are: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We cannot add other headings. So we must fit measures of success into one of those. Probably under Responsibilities (as expectations) or maybe under Requirements? I'd put under Responsibilities as part of what you'll do.
Compensation: Pay section.
Benefits: Benefits section.
Schedule: none.
Thus we will have sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay.
But we need to avoid thin sections. Let's see if we can combine Requirements and Qualifications into one (Requirements). Skills maybe separate.
But we have a lot of technical skills; we could put them under Skills.
Let's decide:
- About the role: intro paragraph.
- Responsibilities: list of duties (the bullet list) plus measures of success (first month, three months, six months) maybe as sublist.
- Requirements: experience requirements (years, etc.) plus education (Bachelor's degree) plus soft skills traits.
- Skills: technical skills (programming languages, tools, AI, etc.) plus preferred experience? Preferred experience could be under Skills or Requirements? Usually preferred experience is separate but we can include under Skills as "Preferred" maybe.
But we need to avoid duplication: many items appear both in requirements and skills. Let's extract distinct.
Requirements (mandatory):
- 5+ years relevant Penetration Testing, Product Security, Application Security experience.
- 2+ years securing Java, Python, and/or JavaScript web applications.
- Experience with advanced security tools and techniques for simulating real-world attacks.
- Familiarity with OSSTMM, OWASP, SAMM, NIST, PTES.
- Experience testing against compliance frameworks PCI, FISMA, HIPAA, FedRAMP, HITRUST.
- Strong working knowledge of at least two programming or scripting languages.
- Familiarity with best practices for securing the SDLC and DevOps processes.
- Ability to triage security incidents when needed.
- Experience with AI security tooling and context-aware SSDLC automation.
- Understanding of AI privacy and governance in developer workflows.
- Experience using and building collaborative agentic AI systems.
- Demonstrated proficiency in leveraging AI tools (Claude, Gemini, ChatGPT, Copilot) to solve real-world business challenges, drive measurable outcomes, or streamline workflows.
- Bachelor’s degree or equivalent certification and experience.
- Soft skills: grounded in security principles, policies, and industry best practices; excellent verbal/written communicator; developing/established leader who mentors; advocate for remediation.
Preferred Experience (optional but we can include under Skills or a separate "Preferred" but not allowed heading). Could be included under Skills as "Preferred"
for prose. Do NOT repeat job title as heading. Do NOT include Job ID etc. Remove boilerplate. Include only sections with real content. We need to parse the posting. Key content: - Intro: "Joining Collibra’s Product Security team Collibra is seeking a Senior Product Security Engineer to join our high-impact team. You will be a key individual responsible for identifying vulnerabilities and providing expert remediation consulting for our global product development teams. This role provides critical technical leadership and oversight, ensuring Collibra continues to deliver secure, resilient products and services to our customers. You will act as an application security evangelist, partnering with engineers to accelerate secure time-to-value while leveraging cutting-edge AI and MCP to create context-aware security automation." That's about the role. Then bullet list: "Product Security Engineers at Collibra are responsible for" then list items: - Application Penetration Testing (Web-app, API, Thick Client) - Network Penetration Testing (Internal, External) - Cloud Service penetration testing tradecraft and methodologies across multiple service providers (AWS, Azure, GCP) - Threat Modeling - Source-Code Reviews - Ensure quality reports and services are delivered efficiently and on time - Collaborate with cross-functional teams to ensure that security best practices are integrated into the development process - Enable remediation of discovered vulnerabilities through the building of relationships with engineering teams - Continue to develop professional skills with relevant industry specific certifications or training - Assist with triaging Code Security findings identified by SAST, SCA, IAST, DAST, where necessary. - Leverage AI and MCP to create intelligent, context-aware security guidance and automation. Then "You have" list of requirements/experience: - 5+ years of relevant Penetration Testing, Product Security, and Application Security experience. - 2+ years securing Java, Python, and/or JavaScript web applications. - Experience with advanced security tools and techniques for simulating real-world attacks. - Familiarity with Open-Source Security Testing Methodology Manual (OSSTMM), Open Web Application Security Project (OWASP), Software Assurance Maturity Model (SAMM), National Institute of Standards and Technology (NIST) Special Publications, and PTES (Penetration Testing Execution Standard). - Experience testing against compliance frameworks such as PCI, FISMA, HIPAA, FedRAMP, or HITRUST. - Strong working knowledge of at least two programming or scripting languages. - Familiarity with best practices for securing the SDLC and DevOps processes. - Ability to triage security incidents when needed. - Experience with AI security tooling and context-aware SSDLC automation. - Understanding of AI privacy and governance in developer workflows. - Experience using and building collaborative agentic AI systems. - Demonstrated proficiency in leveraging AI tools (e.g., Claude, Gemini, ChatGPT, Copilot) to solve real-world business challenges, drive measurable outcomes, or streamline workflows. - A Bachelor’s degree or equivalent certification and experience. - Demonstrated proficiency in leveraging AI tools (e.g., Claude, Gemini, ChatGPT, Copilot) to solve real-world business challenges, drive measurable outcomes, or streamline workflows. (duplicate) - A bachelor’s degree or equivalent related working experience is required (duplicate) - This position is not eligible for visa sponsorship (metadata, maybe drop) - You are (list of traits): - Grounded in security principles, policies, and industry best practices. - An excellent verbal and written communicator, able to produce assessment reports, presentations, and operating procedures. - A developing or established leader who matures security practices and mentors junior teammates. - An advocate for the remediation of application security risk and, simultaneously, the associated development/engineering teams. Then "Preferred Experience" list: - Relevant security certifications strongly preferred (e.g. OSCP, OSWE, CRTP) - Red/Purple team operations - Possess a working knowledge of Python, Java, and/or JavaScript software development languages - Experienced in performing security assessments against containerized cloud environments. - Familiarity with AI standards and regulations, EU AI Act, SAIF and ISO 42001. Then "Measures of success" bullet list: - Within your first month, you will build foundational knowledge of Collibra’s processes, tools, and SDLC. You will use that knowledge to design and implement repeatable penetration-testing methodologies tailored to the environment. - Within your first three months, you will independently plan and execute penetration-testing engagements, then partner with development teams to understand, prioritize, and remediate identified security issues. - Within your first six months, you will partner with your leader to develop a security roadmap for comprehensive, proactive assessments across Collibra. You will incorporate threat intelligence to anticipate emerging threats and identify potential security gaps. Then "Compensation for this role" paragraph: - The standard base salary range for this position is $168,000.00 - $210,000.00 per year. This position is not eligible for additional commission-based compensation. Salary offers are based on a combination of factors, including, but not limited to, experience, skills, and location. In addition to base salary, we offer a competitive total rewards package, including bonus potential, equity for eligible roles, a Flex Fund monthly stipend, pension/401k plans, and more. Then "Benefits at Collibra" paragraph: - Collibra recognizes and values that everyone has different needs, interests, and life goals. We built our benefits program with flexibility in mind to support you and your loved ones through a diverse range of circumstances and life events. These flexible offerings sit on a foundation of competitive compensation, health coverage, and time off. Learn more about Collibra’s benefits. Then inclusion and belonging paragraph, EEO etc. Those are boilerplate; we should remove EEO/equal-opportunity etc. The instructions: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we should drop the inclusion paragraph and EEO statement. Thus we have sections: - About the role (intro paragraph) - Responsibilities (list of duties) - Requirements (maybe combine required experience and qualifications) - Qualifications (maybe education) - Skills (maybe technical skills) - Benefits (benefits paragraph) - Pay (compensation paragraph) - Schedule? Not mentioned. So we should not create Schedule section. We need to decide which headings to include. The instruction: "Prefer a few substantive sections over many thin ones." So we can combine similar items. Potential sections: - About the role (intro) - Responsibilities (list) - Requirements and Qualifications (combined) - Skills (maybe technical skills) - Benefits - Pay But we need to avoid duplication. Let's extract distinct content. Responsibilities list: the bullet list after "Product Security Engineers at Collibra are responsible for". That's responsibilities. Requirements: the "You have" list (experience, years, etc.) plus maybe "You are" traits (soft skills). Could be considered requirements. Qualifications: education (Bachelor's degree or equivalent). Could be part of requirements. Skills: technical skills like programming languages, tools, AI, etc. Could be separate. But we can combine Requirements and Qualifications into one section "Requirements". Or we can have "Requirements" and "Qualifications" separate if there is distinct content. Let's see distinct content: - Experience: 5+ years relevant Penetration Testing, Product Security, Application Security. - 2+ years securing Java, Python, and/or JavaScript web applications. - Experience with advanced security tools and techniques for simulating real-world attacks. - Familiarity with OSSTMM, OWASP, SAMM, NIST, PTES. - Experience testing against compliance frameworks PCI, FISMA, HIPAA, FedRAMP, HITRUST. - Strong working knowledge of at least two programming or scripting languages. - Familiarity with best practices for securing the SDLC and DevOps processes. - Ability to triage security incidents when needed. - Experience with AI security tooling and context-aware SSDLC automation. - Understanding of AI privacy and governance in developer workflows. - Experience using and building collaborative agentic AI systems. - Demonstrated proficiency in leveraging AI tools (Claude, Gemini, ChatGPT, Copilot) to solve real-world business challenges, drive measurable outcomes, or streamline workflows. - Bachelor’s degree or equivalent certification and experience. - This position is not eligible for visa sponsorship (metadata, drop) - You are traits: grounded in security principles, excellent communicator, developing/established leader, advocate for remediation. Preferred Experience: list of preferred certifications, red/purple team, working knowledge of Python/Java/JS, containerized cloud assessments, familiarity with AI standards/regulations. Measures of success: could be considered responsibilities or expectations; maybe we can include under Responsibilities or a separate section "Success Metrics". But instruction: include a section ONLY when posting has real, specific content for it. Measures of success is specific content. Could be a section "Success Metrics" but not in the allowed headings list? The allowed headings are: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We cannot add other headings. So we must fit measures of success into one of those. Probably under Responsibilities (as expectations) or maybe under Requirements? I'd put under Responsibilities as part of what you'll do. Compensation: Pay section. Benefits: Benefits section. Schedule: none. Thus we will have sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay. But we need to avoid thin sections. Let's see if we can combine Requirements and Qualifications into one (Requirements). Skills maybe separate. But we have a lot of technical skills; we could put them under Skills. Let's decide: - About the role: intro paragraph. - Responsibilities: list of duties (the bullet list) plus measures of success (first month, three months, six months) maybe as sublist. - Requirements: experience requirements (years, etc.) plus education (Bachelor's degree) plus soft skills traits. - Skills: technical skills (programming languages, tools, AI, etc.) plus preferred experience? Preferred experience could be under Skills or Requirements? Usually preferred experience is separate but we can include under Skills as "Preferred" maybe. But we need to avoid duplication: many items appear both in requirements and skills. Let's extract distinct. Requirements (mandatory): - 5+ years relevant Penetration Testing, Product Security, Application Security experience. - 2+ years securing Java, Python, and/or JavaScript web applications. - Experience with advanced security tools and techniques for simulating real-world attacks. - Familiarity with OSSTMM, OWASP, SAMM, NIST, PTES. - Experience testing against compliance frameworks PCI, FISMA, HIPAA, FedRAMP, HITRUST. - Strong working knowledge of at least two programming or scripting languages. - Familiarity with best practices for securing the SDLC and DevOps processes. - Ability to triage security incidents when needed. - Experience with AI security tooling and context-aware SSDLC automation. - Understanding of AI privacy and governance in developer workflows. - Experience using and building collaborative agentic AI systems. - Demonstrated proficiency in leveraging AI tools (Claude, Gemini, ChatGPT, Copilot) to solve real-world business challenges, drive measurable outcomes, or streamline workflows. - Bachelor’s degree or equivalent certification and experience. - Soft skills: grounded in security principles, policies, and industry best practices; excellent verbal/written communicator; developing/established leader who mentors; advocate for remediation. Preferred Experience (optional but we can include under Skills or a separate "Preferred" but not allowed heading). Could be included under Skills as "Preferred"