Senior Product Security Engineer

aqua IT

REMOTE - must work EST hours, NC(remote)

JOB DETAILS
SKILLS
Amazon Web Services (AWS), Applications Security, Architectural Services, Artificial Intelligence (AI), Artificial Intelligence (AI) Agents, Auditing, Cloud Computing, Code Reviews, Computer Security, Continuous Deployment/Delivery, Continuous Integration, Dynamic Analysis, Emerging Technology, Engineering, GCP (Good Clinical Practices), GitHub, Go Programming Language (Golang), Home Automation, Incident Response, Java, JavaScript, Machine Tool, Maintain Compliance, On Call, Penetration Testing, Product Engineering, Product Support, Product/Service Launch, Production Systems, Proof of Concept, Python Programming/Scripting Language, Research & Development (R&D), Research Skills, Risk, Risk Management, Risk Management Framework (RMF), Scripting (Scripting Languages), Security Analysis, Security Attacks, Software Debugging, Software Development, Software Development Lifecycle (SDLC), Software Engineering, Software as a Service (SaaS), Source Code/Configuration Management (SCM), Testing, Threat Modeling, Validation Testing, Vendor/Supplier Evaluation
LOCATION
REMOTE - must work EST hours, NC
POSTED
4 days ago

Overview: Serve as a senior security engineering resource supporting multiple product and development teams. Lead application and platform security assessments for new features, services, and emerging technologies, including AI-driven solutions. Conduct security testing and vulnerability validation activities, collaborate with engineering teams to remediate findings, and contribute code-based security improvements where appropriate. Manage external vulnerability reporting processes and coordinate risk management, compliance, and audit-related initiatives across the software development organization. Support incident response efforts and participate in an on-call rotation for security events affecting production environments.

Responsibilities:

  • Lead Product Security across our SaaS offerings, partnering with product and platform engineering teams on design, code, and remediation
  • Own Unified Security Review process for new product launches, vendor evaluations, and AI tooling — including custom penetration tests scoped to each review
  • Drive Security Engineering Risk Management Framework, for consistent risk classification and remediation tracking across product
  • Lead the Vulnerability Disclosure Program and security bug reporting workflow, from researcher intake through fix
  • Drive SOC2 and compliance-related security remediation across product engineering, partnering with R&D leads on architectural fixes
  • Provide security review and guardrails for internal AI platforms and coding agents (LLM gateways, prompt/response controls, agent permissioning)
  • Participate in a shared on-call rotation for high-severity production security incidents

Qualifications:

  • 8+ years of application security engineering experience
  • Strong production coding ability in at least one of Java (preferred), TypeScript/JavaScript, Python, or Go — enough to perform deep code review, write proof-of-concept exploits, and contribute fixes directly into product repos
  • Building security automation into CI/CD pipelines
  • Hands-on penetration testing of production SaaS applications, including custom tests scoped to new product launches
  • Threat modeling, secure design reviews, and static/dynamic code analysis across the SDLC
  • Identifying and remediating common web application vulnerabilities (OWASP Top 10)
  • Experience securing internal AI/LLM platforms and coding agents (model gateways, prompt/response controls, agent permissioning)
  • Experience in Web3, Blockchain or Digital Assets (nice to have, not required)
  • Experience building AI workflows, agents, and guardrailing (nice to have, not required)

Tech Stack:

  • Cloud and containers: AWS, GCP, Kubernetes (EKS/GKE)
  • Infrastructure-as-Code: Terraform
  • Security tooling: Wiz, SonarCloud, Burp, Cloudflare
  • CI/CD and source control: GitHub, GitHub Actions, Artifactory and related build/deploy tooling
  • Languages and scripting: Java, JavaScript, Python, Go
  • AI Coding Agents, Tooling, Systems

About the Company

a

aqua IT