Staff Security Engineer, Product Security team (all genders)

Job Description

We are looking for a Staff Security Engineer (all genders) to join our Product Security team on our journey to always deliver amazing experiences.

We are looking for a pragmatic, high-impact individual contributor to join our Product Security team as a Staff Product Security Engineer (IC4). In this pivotal role, you will drive the overarching technical strategy for application security, ensuring we reduce real-world risk across our entire product landscape without slowing down engineering velocity.

You will champion a "Secure by Design" philosophy, moving away from reactive auditing and security gatekeeping. Instead, you will treat security as a collaborative engineering challenge, designing the automated guardrails, developer tooling, and technical frameworks that enable our engineering teams to scale rapidly and securely by default. As a Staff-level individual contributor, your leadership will extend beyond the immediate product boundaries and you will achieve domain-wide impact by seamlessly bridging the gap between Application Security, AI/ML security, Infrastructure Security, and Security Operations.

Your mission:

• Drive Product Security Maturity: Drive the strategic technical roadmap for the Product Security team, ensuring threat-modeling methodologies and secure coding practices scale efficiently across our global web and mobile application ecosystem.

• Lead Threat Modeling & Security Architecture Reviews: Apply your expertise to identify complex security design flaws early in the Software Development Life Cycle (SDLC) using frameworks and automation tools, co-authoring architectural blueprints that are secure by default.

• Scale Vulnerability Management & Governance: Architect and run our vulnerability management program at scale. You will ingest inputs from internal testing, automated tooling, and external Bug Bounty / Vulnerability Disclosure Programs, systematically validating and ranking vulnerabilities based on actual business risk.

• Master Stakeholder Management: Translate complex software and AI-related vulnerabilities into clear, actionable business risks, partnering closely with engineering leadership and product verticals to drive timely remediation without friction. systematically tracking and optimizing metrics such as Mean Time to Remediate (MTTR) and SLA Adherence % to elevate our overall security posture.

• Automate DevSecOps & CI/CD Pipelines: Replace manual gates with seamless DevSecOps workflows, embedding automated security testing tools (SAST, DAST, SCA) directly into developer pipelines to catch high-risk flaws early.

• Pioneer AI-Driven Security Automation: Champion the adoption of artificial intelligence and LLMs to revolutionize our security workflows. You will design and implement cutting-edge AI-powered code security automation, leverage AI for automated vulnerability triage, and build smart security automation guardrails that scale engineering productivity.

• Cross-Domain Collaboration & CSPM Management: Drive domain-wide impact by collaborating with Infrastructure Security to leverage Cloud Security Posture Management (CSPM) platforms, ensuring that application vulnerabilities are contextualized with cloud risk. Partner with Security Operations (Detection & Response) to ensure proper application logging, alerting, and incident readiness.

• Mentor and Inspire: Act as a technical beacon within the security and engineering organizations. Define key security metrics, drive a strong security culture, and mentor junior and senior engineers to foster a world-class community of Security Champions

Qualifications

• Proven Engineering Leadership: A strong track record of driving complex application security and DevSecOps initiatives as a staff-level individual contributor in massive, global software environments.

• Comprehensive Web & Mobile Security: Deep, fundamental understanding of modern web and mobile application security topics, including hands-on experience managing external Bug Bounty and vulnerability disclosure programs.

• AI Security Expertise: Strong working knowledge of industry-standard security frameworks for artificial intelligence, such as the OWASP Top 10 for LLM Applications, MITRE ATLAS, and the NIST AI RMF.

• AI & Security Automation Hands-on Experience: Practical understanding of utilizing artificial intelligence (including LLMs/Generative AI) for security engineering use cases, such as automated vulnerability analysis, script generation, triage optimization, and code security remediation.

• Privacy, Ethics & Regulations: A solid understanding of global data privacy laws (, GDPR), ethical AI considerations, and the regulatory impacts of the EU AI Act on application architecture.

• Risk-Based Vulnerability Management: Strong expertise in vulnerability validation and triage, with the ability to look past raw CVSS scores to calculate actual business impact, coupled with excellent stakeholder management skills to align engineering teams on remediation.

• Secure Coding & Remediation Proficiency: Deep hands-on proficiency in multiple modern programming languages (, Java, Python, Go) and the ability to confidently code, review, and remediate complex vulnerabilities (such as the OWASP Top 10) directly within application repositories.

• Cloud & CSPM Familiarity: Strong working knowledge of cloud security (AWS, GCP, or Azure) and containerized ecosystems (Kubernetes, Docker), alongside an understanding of how to align application security signals with Cloud Security Posture Management (CSPM) platforms.

• Identity & Access Management (IAM): Deep understanding of modern authentication and authorization protocols (OAuth, OIDC, SAML) and how to design and enforce Zero Trust architectures at scale.

• Cross-Functional Security Ops Alignment: Basic working knowledge of security operations, threat detection, and incident response, ensuring that product architectures are built to be auditable, observable, and resilient against live attacks.

Nice to have:

• Experience securing highly distributed, event-driven microservices architectures at global scale.

• History of public security research, CVE discovery, or active contributions to open-source security or AI safety tooling.

• Advanced application security or cloud certifications (, CSSLP, CASE, AWS Security Specialty, Google Professional Cloud Security Engineer, or CISSP).