Senior Product Security Engineer

We need to output HTML fragment with sections: About the role? Actually the posting includes description paragraphs. We need to use

for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections when posting has real specific content. The posting includes: description (intro) maybe "About the role". Then responsibilities (What You Will Do). Then requirements/qualifications/skills (What You Will Need). Then benefits (What You Will Get). Also salary range is given: $160,000 to $200,000 commensurate with experience and skills. According to rules: we should not create Pay section unless posting actually states them. It does state salary range, but it says "commensurate with experience and skills". The rule says: never emit a heading followed by filler/placeholder text (e.g., "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. The phrase "commensurate with experience and skills" is considered filler? It says "commensurate with experience and skills" is like placeholder? The rule says never emit a heading followed by filler/placeholder text (e.g., "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. So if we include Pay section, the content would be the salary range but includes "commensurate with experience and skills". That might be considered filler. However the posting does state a range: $160,000 to $200,000. That's specific. The phrase "commensurate with experience and skills" is additional but not filler? The rule example includes "commensurate with experience" as filler to avoid. So we should avoid Pay section because it would be accompanied by that phrase. Better to embed salary info within another section? But we cannot invent sections. Could we include it in a

under Benefits? Probably not. The instruction: "Prefer a few substantive sections over many thin ones." And "include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text". So if we include Pay heading, we must have specific content not just filler. The salary range is specific, but the phrase "commensurate with experience and skills" is filler. However we could still include the range and ignore the phrase? But we must preserve ALL substantive information; we cannot omit the phrase "commensurate with experience and skills" because it's part of the posting. However it's not substantive? It's basically saying salary depends on experience. Might be considered filler. The rule says never emit a heading followed by filler/placeholder text (e.g., "commensurate with experience", ...). So if we include Pay heading, the content would start with that phrase, making it filler. So better to omit Pay section entirely. Similarly Benefits: they list "The unique and exciting opportunity to work at one of a leading global entertainment companies", etc. That's substantive. So we can have Benefits section. Schedule: not mentioned, so omit. Thus sections: About the role (intro paragraph), Responsibilities (What You Will Do), Requirements (What You Will Need) maybe combine Requirements, Qualifications, Skills? The posting has "What You Will Need" which includes education, experience, etc. Could treat as Requirements. Could also have Skills separate but we can combine into one section to avoid thin sections. The rule: prefer a few substantive sections over many thin ones. So we can have About the role, Responsibilities, Requirements, Benefits. We need to use

for each section heading. Use

• for any list of duties/requirements/benefits. Use

  for prose. We need to preserve all substantive information, not invent or summarize away detail. So we need to capture all bullet points from responsibilities, requirements, benefits. Let's extract. Intro paragraph: "UTA seeks a Senior Product Security Engineer to help embed security into the design, development, and operation of our products and platforms. In this role, you will work closely with engineering, product, and security teams to design and implement security controls across our applications and services, safeguarding our brand, our people, and our digital assets. If you are passionate about building secure products from the ground up and enjoy operating at the intersection of software development and cybersecurity, this role offers the opportunity to meaningfully shape UTA’s product security posture. The salary range for this role is $160,000 to $200,000 commensurate with experience and skills." We might keep salary info in About the role paragraph? It's part of intro. We'll keep it. Responsibilities: "What You Will Do" with several bullet-like paragraphs. Need to turn each into

• . The text includes multiple paragraphs each starting with a bold heading? Actually they have headings like "Product security strategy & architecture", then paragraphs. We need to capture all substantive content. We'll break into list items for each major bullet. Let's list responsibilities: - Product security strategy & architecture - Lead security design and architecture reviews for new and existing products, including web, mobile, and cloud-based custom applications, and provide clear, actionable recommendations - Support the security of UTA’s custom-built digital products and platforms, including web applications, cloud services, agentic workflows, data-driven tools, AI-enabled business tools, and custom tools used by employees, business teams, and external partners and clients - from design through deployment and ongoing operation - Partner with product and engineering leadership to define product security requirements, risk tolerances, and security roadmaps across multiple teams and initiatives - Conduct and facilitate threat modeling workshops to proactively identify emerging risks and attack vectors and drive mitigations into product design - Conduct security reviews for products and services deployed across AWS, Azure, and GCP including cloud-native architectures, and platform-specific security controls - Secure development lifecycle & testing - Own and mature the application and product security lifecycle, including threat modeling, secure design, secure coding practices, testing, and release validation - Assess and secure early-stage product design, architecture and workflows, associated with rapid prototyping and deployment - Drive the adoption of automated security checks in CI/CD pipelines (SAST, DAST, SCA, secrets scanning, etc.) and ensure they are tuned to balance risk reduction with developer velocity - Lead and coordinate application security testing efforts, including tool-based and manual reviews, and work closely with development teams to prioritize and remediate findings - Establish and evangelize secure coding standards, patterns, and reusable frameworks that can be leveraged across engineering teams - Lead API security assessments, including authentication/authorization validation for REST/GraphQL APIs and API gateway configuration reviews - Help establish security controls for AI-assisted software development, including AI-generated code review, agent-driven pull requests, dependency integrity, secrets prevention, and secure use of coding assistants such as Claude Code, Cursor, GitHub Copilot, or similar tools. - Operations, monitoring & incident response - Collaborate with security operations to ensure product-related logs, alerts, and events are captured, correlated, and integrated into monitoring and incident response workflows - Own vulnerability triage and management for product and application findings, including those surfaced through penetration tests and attack surface monitoring, covering risk assessment, remediation planning, and validation of fixes - Ensure products handle sensitive data appropriately, including data classification, storage, transit, and retention practices aligned with organizational security requirements - Tooling, enablement & leadership - Evaluate, select, and help implement product security focused tools and services, influencing build vs buy decisions - Develop documentation, playbooks, and training to raise the overall level of security awareness and capability across product and engineering teams - Provide best practices on the secure use of AI-assisted development tools, including risks around dependency integrity, code suggestions, and agent-driven changes - Partner with engineering, DevOps, and security operations to mature vulnerability operations, including reachability-based prioritization, AI-assisted triage and remediation, developer-native fix workflows, and automated validation that critical attack paths have been closed We could flatten each bullet as
• items, but that would be many items. That's okay. Requirements: "What You Will Need" includes: - Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related field; or equivalent practical experience - 5+ years of experience in security engineering, application security, or product aligned security roles, with a track record of owning and driving security initiatives - Deep understanding of common web, mobile, and API vulnerabilities (e.g., OWASP Top 10) and practical experience preventing and remediating them at scale - Strong experience securing applications and services in at least one major cloud provider (AWS preferred), including cloud native architectures - Hands on experience with application security tooling (SAST, DAST, SCA, secret scanning, WAF, or similar) and integrating these into CI/CD workflows - Familiarity with secure deployment practices, including Infrastructure-as-Code review of Terraform, CI/CD pipeline security (GitHub Actions), and secrets management. - Familiarity with container security, including image hardening, Kubernetes RBAC, network policies, and runtime protection. - Familiarity with securing AI/ML platforms in cloud environments and agentic workflows, including access control, data protection, and governance across the application development and deployment lifecycle. - Solid experience collaborating with software engineering teams in agile environments, including participating in design reviews, code reviews, and sprint planning - Strong knowledge of identity, authentication, and authorization concepts and technologies (e.g., OAuth, OIDC, SSO, modern identity platforms) - Excellent communication and stakeholder management skills, with the ability to influence senior technical and nontechnical partners and drive consensus Benefits: "What You Will Get": - The unique and exciting opportunity to work at one of a leading global entertainment companies - Access to the tools, leadership, and resources you will need to create and drive a center of excellence - The opportunity to do the best work of your career - Work in an inclusive and diverse company culture - Competitive programs to support your well-being - Experience working in a collaborative environment with room to grow Also there is "About UTA" paragraph but that's boilerplate? It's about the company. Might be considered substantive but not required. The instruction: remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The "About UTA" is not boilerplate but maybe considered company overview. Could keep as part of About the role? Might be okay to include as a separate section? But we already have About the role intro. Could add a paragraph about UTA after the intro. It's substantive. We'll include as a

  under About the role? Could add another

  . We'll keep it. We must not include EEO statement etc. At end there is "UTA and its Affiliated Companies are Equal Employment Opportunity employers..." that's boilerplate, remove. Also remove the link to privacy policy etc. Now construct HTML. Structure:

  About the role

  UTA seeks a Senior Product Security Engineer to help embed security into the design, development, and operation of our products and platforms. In this role, you will work closely with engineering, product, and security teams to design and implement security controls across our applications and services, safeguarding our brand, our people, and our digital assets. If you are passionate about building secure products from the ground up and enjoy operating at the intersection of software development and cybersecurity, this role offers the opportunity to meaningfully shape UTA’s product security posture. The salary range for this role is $160,000 to $200,000 commensurate with experience and skills.

  UTA is a premier global talent agency built for the future of media and entertainment. The agency's diversified platform and best-in-class, client-first approach is innovative, collaborative, and