Senior Staff Product Security Engineer, AI Security & Security Assurance

About the role

Medallia is the pioneer and market leader in Experience Management, offering the award‑winning SaaS platform Medallia Experience Cloud. The company is seeking a Senior Staff Product Security Engineer to lead security strategy and assurance for AI‑powered products, agentic systems, next‑generation platforms, and emerging technologies. This role serves as the technical leader for AI Security and Security Assurance, partnering with Product, Engineering, Architecture, Data Science, and Security teams to embed security into the design, development, and deployment of modern AI‑enabled capabilities.

Responsibilities

• Serve as the technical authority for security reviews involving Generative AI applications, LLM‑powered features, AI agents, agentic workflows, MCP (Model Context Protocol) integrations, AI skills and marketplaces, AI coding assistants, and Bring Your Own Model (BYOM) capabilities.
• Define security requirements and guardrails for AI‑enabled products and services.
• Evaluate emerging AI technologies and assess associated security risks.
• Partner with engineering and product teams to ensure AI features are secure by design.
• Lead threat modeling efforts for critical product and platform initiatives; establish and scale a threat modeling program across engineering organizations.
• Conduct security architecture reviews for high‑risk and strategic initiatives; develop security reference architectures, design patterns, and guidance for engineering teams.
• Identify systemic security risks and drive long‑term remediation strategies.
• Own and evolve product security assurance activities, including security reviews, assessments, AI security reviews, testing strategies, and security requirements and standards; define risk‑based approaches for evaluating emerging technologies.
• Embed security validation throughout the SDLC in partnership with engineering teams.
• Establish secure development standards for AI‑enabled applications; drive adoption of secure coding practices; develop scalable developer guidance and security enablement programs; evaluate and implement AI‑assisted security review capabilities.
• Identify opportunities to automate security reviews; partner with security tooling owners to improve developer experience and coverage; define metrics that measure the effectiveness of AI security and security assurance programs; evaluate emerging security technologies relevant to AI and modern software development.
• Partner closely with Product, Engineering, Architecture, Data Science, Privacy, Legal, Compliance, and Operations teams; influence technical direction through expertise and relationship‑building; mentor staff and senior engineers in threat modeling, architecture reviews, and AI security.

Minimum Qualifications

• 12+ years of experience in Product Security, Application Security, Security Architecture, or Security Engineering.
• Proven experience operating at Staff or Senior Staff level within a technology organization.
• Expertise in Threat Modeling, Security Architecture Reviews, Application Security, Cloud Security, Secure SDLC, Vulnerability Management, and Secure Design Principles.
• Experience securing modern architectures including APIs, Microservices, Kubernetes, Containers, and cloud‑native platforms.
• Strong understanding of security frameworks and standards such as OWASP, NIST, SOC 2, ISO 27001, and PCI DSS.
• Demonstrated ability to influence engineering organizations and drive security outcomes without direct authority.

Preferred Qualifications

• Experience securing Generative AI applications, LLM‑based products, AI agents, agentic workflows, MCP integrations, and Retrieval‑Augmented Generation (RAG) systems.
• Familiarity with AI security concepts including Prompt Injection, Indirect Prompt Injection, Tool Abuse, Agent Authorization, Data Leakage, Model Abuse, and AI Threat Modeling.
• Experience developing security guidance for AI‑enabled software development.
• Security certifications such as CISSP, CSSLP, GIAC, AWS Security Specialty, or equivalent.

Pay

The annual base salary range for this position is $184,000 – $245,000. This range is a general guideline that reflects all U.S. labor markets; actual compensation will consider factors such as scope and responsibilities, work experience, location, education, key skills, internal equity, market data, and business considerations.

Benefits

• Medical, dental, and vision coverage
• 401(k) retirement plan
• Short‑term and long‑term disability insurance
• Life and AD&D insurance
• Statutory leaves
• Paid parental leave
• Paid holidays
• Additional competitive health and wellness benefits