Principal or Staff Product Security Engineer

Join our team as a Principal or Staff Product Security Engineer, where you'll be responsible for the day-to-day execution of our product security program across our cloud backend, mobile apps, and Android platform. You'll work closely with the Head of Security and be the go-to person for hands-on security expertise. Your responsibilities will include managing the vulnerability management pipeline, running our bug bounty program, leading security design reviews, and providing metrics and data on findings and remediation. This is a remote position with a range of benefits including health insurance, a learning stipend, and a collaborative work culture.

• Own the day-to-day execution of the product security program, including vulnerability management, bug bounty program, and security scanning.
• Work closely with engineering teams to provide hands-on security expertise, lead security design reviews, and drive remediation of vulnerabilities.
• Manage third-party penetration testing engagements, lead security design reviews, and provide metrics and data on findings to support compliance.

• Hands-on experience running or triaging a bug bounty program
• Clear written communication and the ability to explain risk to both engineers and non-technical stakeholders
• 6+ years in application or product security, with a software engineering background. You can ship production code, not just review it
• Deep experience securing backend services and APIs, including OAuth 2.0/OIDC, PKCE, MFA, session management, and token handling
• Experience building and maintaining security tooling and automation (static analysis, CI integrations, custom scanners), and comfort working with LLM-based systems
• A track record of getting engineering teams to prioritize and fix security issues through influence and good judgment, not escalation
• Mobile application security experience (OWASP MASVS), ideally including shipping fixes in a mobile codebase
• Android platform or app security experience
• Experience assessing AI/LLM features for risks like prompt injection and data leakage
• Exposure to embedded, IoT, or firmware security
• Familiarity with children's privacy requirements (e.g. COPPA) or other sensitive consumer data
• Incident response experience
• Familiarity with the EU Cyber Resilience Act or UK PSTI