Product Security Engineer

Join WorkOS as a Product Security Engineer, where you'll play a crucial role in keeping the data and identities of millions of users secure. You'll lead secure design efforts, build secure systems, perform offensive security testing, improve security tooling, operate the responsible disclosure program, enhance our products, and engage directly with customers. Enjoy a range of benefits, including health insurance, retirement matching, paid vacation, and stipends for fitness and mental well-being.

• Lead secure design efforts and partner with engineering teams on secure design and code reviews.
• Conduct penetration tests and code audits on new and existing products from an adversarial lens.
• Integrate and improve our static analysis, supply chain security, and vulnerability management capabilities across engineering pipelines.

• Risk-focused and pragmatic. You excel at identifying and reasoning about security risk in real-world contexts. You prioritize ruthlessly, always asking: what's the most effective way to reduce risk right now and in the long term?
• Curious and humble. You ask the basic questions, enjoy untangling complex systems, and bring others along with you
• A strong partner to engineering. You build trust with engineers by understanding their priorities, making security frictionless, and finding ways to make the secure path, the easiest path
• A builder who can break things. You're comfortable reading and writing code, and you have a passion for deeply understanding the products you secure. You think like an attacker to find subtle, high impact vulnerabilities and like a defender to design pragmatic, effective mitigations
• Excited about AI. You're embracing AI and automation to scale security and reduce toil
• Bonus: Experience writing production level code, especially developing security features
• Comfortable reading and writing code, and able to effectively leverage AI during the process
• Strong written and verbal communication skills, particularly in partnering with engineering teams
• Familiarity with and experience using common industry tooling
• 5+ years of experience in a security engineering or security-focused software engineering role
• Ability to execute across a wide range of security functions such as security assessments, penetration testing, responsible disclosure, security tooling integration, etc
• Bonus: Experience in the authentication and identity domain
• Proven ability to identify vulnerabilities in software, demonstrated through CVEs, bug bounty, blog posts, or prior work experience