Senior Product Security Engineer
Own Anyscale’s secure software development lifecycle, partner with engineering on secure architecture and features, and lead vulnerability management and remediation. The role requires 8+ years of product or application security experience and strong hands-on secure-development expertise.
About the job
Responsibilities
- Own and operate a scalable secure software development lifecycle (SSDL), including threat modeling, security requirements, secure design practices, and scanning.
- Partner with engineering on security features and secure-by-design architecture from early design through implementation.
- Review the security of existing systems and new initiatives, turning findings into prioritized, actionable work.
- Own vulnerability management for shipped products: enumerate components, map known vulnerabilities, and provide accurate posture reporting.
- Drive vulnerabilities to resolution with engineering against defined SLAs.
- Own software composition analysis, secret scanning, and SAST across product repositories.
- Mentor engineers and raise the organization’s security bar.
Requirements
- 8+ years of product or application security experience, ideally in a high-growth startup.
- Demonstrated ownership of an SSDL at scale, including threat modeling and secure design review.
- Hands-on experience partnering with engineering on security features and architecture.
- Deep experience with software composition analysis, secret scanning, SAST, or secure-development tooling.
- Understanding of software supply chain security and component enumeration, including SBOM approaches.
- Experience triaging vulnerabilities using CVSS and business context and driving remediation with engineering.
- Strong communication and seniority to set direction, review work, and mentor others.
Nice to Have
- Experience producing vulnerability or security posture reporting for enterprise or regulated customers.
- Familiarity with container artifact security, including image scanning, signing, and SBOM generation.
- Experience building or maturing an SSDL program at scale.
- Background in AI or ML platforms or distributed systems.
Skills
Threat Modeling, Secure Design, Vulnerability Management, Software Composition Analysis, Secret Scanning, SAST, Software Supply Chain Security, Sbom, Cvss, Container Security, Image Scanning, Security Architecture
Similar jobs
Security Engineering jobs
Monarch
Remote
Own and scale security governance, risk, compliance, and customer assurance programs, including audits, controls monitoring, third-party risk, policies, and security questionnaires. The role requires 3–5 years of security GRC experience and hands-on understanding of IAM, endpoint, and cloud controls.
Valon
United States
Leads offensive security, threat intelligence, security testing, and incident response across applications, infrastructure, and networks. The role requires at least five years of relevant experience, cloud security expertise, AI and automation experience, and a bachelor's degree.
Anyscale
San Francisco, CA
Own Anyscale’s compliance function end to end, leading SOC 2 and ISO 27001 programs, audit readiness, customer security diligence, and enterprise risk management. The role requires 7+ years in governance, risk, and compliance plus strong cloud and SaaS security-controls expertise.
Siftstack
Marina Del Rey, CA
The Senior Application Security Engineer will build secure-by-default software patterns, supply-chain controls, and developer-facing security tooling across a distributed systems platform. The role requires 5+ years of production software experience, strong application security expertise, and depth in Go or Rust.
Fireworks AI
San Mateo, CABuild and lead Fireworks AI’s security operations function, owning detection engineering, incident response, threat intelligence, and SecOps workflows. The role requires 7+ years of security experience, hands-on EDR and cloud security expertise, strong Python automation skills, and the ability to grow an IC function into a team.