Product Security Engineer

The Product Security team is seeking a Product Security Engineer to implement secure development practices in a fast-paced, agile development environment. You will be responsible for defining security requirements, adoption and configuration of security tooling and platforms, threat modeling and risk assessment, secure architecture reviews, secure code reviews and security testing. Following a shift-left approach, you will partner closely with product engineering teams. A successful candidate is a self-driven security professional, able to effectively communicate with stakeholders to improve product security posture.

Responsibilities: 

• Assess security posture of cloud environments of SaaS based products in Azure, identify risks and drive remediation and improvement to address the gaps 

• Partner with Engineering, DevOps and SRE to integrate secure development practices in each stage of SDLC 

• Perform threat modeling, security assessments and drive security testing for products 

• Understanding the Azure cloud adoption framework and security implications of building cloud-based products.  

• Analyze security issues in products, Cloud environment and applications including triage coordination, tracking and remediation of security incidents 

• Continuously learn and stay up to date with new technologies, tooling and techniques in cloud and security

• Provide consultation and educate developers in SaaS security. Participate in internal security community content and activities.

In order to be considered for this role, you must have: 

• 2+ years of experience in cybersecurity or related field 

• Solid understanding and experience with Microsoft Azure specifically and cloud computing in general and tooling around cloud security  

• Solid understanding of DevSecOps principles and CI/CD systems 

• Understanding of security concepts including common vulnerabilities (OWASP Top 10, SANS 25), secure development practices (code review, threat modeling), security tooling (SAST, DAST, SCA) 

• Ability to communicate and coordinate with stakeholders remotely 

• Passion to learn and grow in cybersecurity field. Ability to mentor junior team members 

• Following is considered a plus: 

• Recognized industry certifications (CEH, OCSP, GIAC ...) 

• Experience with governance and security certifications (SOC2, ISO27001, FIPS) 

• Bsc/Msc degrees or equivalent formal education in cybersecurity or related fields