# Principal Security Engineer, Product & Infrastructure

**Company:** [Pigment](https://hotfix.jobs/companies/pigment)
**Location:** Remote
**Role:** Security Engineering
**Salary:** €80k – €120k/yr
**Experience:** 8+ years
**Skills:** GCP, Kubernetes, Terraform, Postgres, Vault, Okta, OAuth, Jwt, C#, .Net Core, TypeScript, React, Python, Go, Datadog
**Posted:** 2026-03-18

> Own the product and infrastructure security roadmap as a hands-on individual contributor, covering threat modeling, vulnerability management, detection, incident response, assurance, and secure SDLC practices. Requires 8+ years of security experience and deep technical breadth.

## Job Description

## Responsibilities
- Own and execute the security roadmap for the product, infrastructure, and CI/CD environment.
- Design product security features and strengthen platform defense in depth.
- Threat-model new services and make security-sensitive architectural decisions.
- Conduct code, architecture, and infrastructure-configuration reviews; provide pragmatic risk assessments and solutions.
- Run assurance activities, including internal reviews, red-team exercises, bug-bounty operations, third-party auditor relationships, and certification control KPIs.
- Manage vulnerabilities from detection through verified remediation, including reproduction, scoring, triage, mitigation validation, and process improvement.
- Build detection capabilities, detection rules, signal collection, and incident-response playbooks.
- Lead production security and fraud investigations from initial signal through root cause.
- Define secure SDLC direction through guidance, paved paths, and engineering reviews.
- Secure AI features, including MCP Server and Modeler Agent implementations.
- Evaluate the appropriate use of AI-assisted security analysis alongside SAST and SCA.
- Migrate GitHub to managed identities and short-lived OIDC credentials.
- Design agent identity and delegated-access controls for the MCP Server.
- Advance least-privilege controls across production and CI/CD.

## Requirements
- At least 8 years of professional security experience as a Security Engineer, Pentester, or Security Consultant.
- Deep experience in product and/or infrastructure security.
- Ownership of a security roadmap for a product or platform.
- Experience driving security initiatives through teams without direct authority.
- Experience making and escalating complex architectural security decisions.
- Hands-on experience across development, databases, networking, and web technologies.
- Fluent English.
- French is a strong plus.
- This is an individual-contributor role with no people-management responsibility.

## Technical Environment
- GCP, Kubernetes, Terraform, Postgres, SingleStore, Vault
- Okta, OAuth, JWT, C#, .NET Core, TypeScript, React, Python, Go
- Datadog, Cloudflare ZTNA, Falco, Wiz, Riot, HackerOne, TruffleHog
- GitHub, CircleCI, ArgoCD
- SOC 1, SOC 2, ISO 27001, ISO 27017, ISO 27018, ISO 42001
- macOS, Windows, Linux

## Compensation and Benefits
- Annual compensation of €80,000–€120,000.
- Stock options.
- Fully paid health insurance for the employee and family.
- Weekly lunches and flexible lunch vouchers.
- Egym Wellpass membership across France.
- Annual learning stipend.
- Remote-work stipend.
- Annual company offsite.
- High-end work equipment.

## Similar jobs

- [Staff Security Engineer](https://hotfix.jobs/jobs/8b105bcc-9ee5-437e-ba10-39c400771fe6) - Mozilla - Remote
- [Senior Security GRC Analyst](https://hotfix.jobs/jobs/b54fb115-3bb7-4d88-8fdc-b7901d26d90d) - Monarch - Remote - $180k – $215k/yr
- [Lead Product GRC Subject Matter Expert](https://hotfix.jobs/jobs/57c937d5-05e3-4033-875a-890645c4aa6b) - Vanta - Remote - $230k – $270k/yr
- [Security Engineer - Product](https://hotfix.jobs/jobs/d32dc9fa-f31b-4fc4-a7c6-eade39acfb64) - Wiz - Berlin, Germany
- [Senior Platform Security Engineer](https://hotfix.jobs/jobs/2d2e8f49-d976-44d0-b98d-691a66f7afff) - Datadog - Paris, France

**Apply:** https://hotfix.jobs/jobs/758322a7-a57c-47c3-847d-8df678a7c93d
**Canonical:** https://hotfix.jobs/jobs/758322a7-a57c-47c3-847d-8df678a7c93d