Product Security Engineer

Description

The company builds an agentic personalization platform, using AI agents to personalize the whole customer journey.

Its products cover autonomous search, conversational shopping and autonomous marketing, all run on one AI engine so that personalization stays consistent.

The company serves more than 1,400 global brands, including American Eagle, Sonepar and Pandora, across retail, financial services, hospitality and gaming.

This role makes you the security lead for a specific product area, covering threat modeling, security assessments and vulnerability management.

Goals for the first 30 days: learn the product portfolio, architecture and core services, the internal security policies and standards, the tools the team uses, and the assessment and threat modeling processes, and start building relationships with Engineering, DevOps and Compliance.

Goals for the first 60 days: contribute to penetration tests and assessments of web applications, join threat modeling sessions, triage scanner and manual findings, and expand your knowledge of product architecture and AI and LLM security risks.

Goals for the first 90 days: run well-defined assessments on your own, escalate complex or high-risk issues, work directly with Engineering on findings and fix validation, and take on more ownership of your areas and improvements to team processes.

Responsibilities

• Help roll out Secure Software Development Lifecycle (SSDLC) practices across engineering teams, so security is part of product development from the start.
• Review application designs, system architectures and infrastructure components, with guidance where needed, to find security risks and suggest mitigations.
• Join threat modeling for new and existing products, identifying threats, assessing risk and writing up practical security recommendations.
• Advise product and engineering teams using established security standards, patterns and best practices, and escalate complex concerns.
• Carry out security assessments, penetration tests and validation testing on applications and environments, following established methods and processes.
• Triage, validate and assign vulnerabilities from security tools and assessments, and work with the right stakeholders to get them fixed on time.
• Work with engineering, DevOps, compliance and other cross-functional teams to meet security requirements and support secure product development.
• Build knowledge of your assigned product areas and act as the security contact for routine questions and tasks, turning to senior team members for complex or higher-risk matters.

Requirements

• At least 2 years of hands-on work in cybersecurity, application security, product security or a closely related security field.
• Practical experience performing or supporting security assessments and penetration tests of web applications.
• Familiarity with threat modeling methods such as STRIDE, and the ability to spot common threats and security risks.
• Solid grasp of vulnerability management, including validating findings, prioritizing by risk, tracking remediation and retesting.
• Exposure to AI and LLM technologies, and an interest in learning their security risks and controls.
• Working knowledge of modern application architectures, APIs, authentication and authorization mechanisms, and common application security issues.
• Knowledge of OWASP standards and resources, including the OWASP Top 10, the Testing Guide and secure development practices.
• Hands-on experience with, or familiarity with, security testing tools such as Burp Suite, OWASP ZAP, Nmap, SAST and SCA tools, and other application security technologies.
• Ability to analyze and validate findings and rank vulnerabilities by technical risk and business context, with guidance where needed.
• Clear written documentation of findings, and the ability to explain technical concepts to engineers and other stakeholders.
• Self-motivated and proactive, willing to learn, take ownership of tasks and help improve processes.
• A team-oriented approach and the ability to work well with Security, Engineering, DevOps and other cross-functional teams.
• A commitment to continuous learning, with a real interest in building deep security skills and keeping up with new technologies and threats.
• Excellent English, with strong listening, speaking, reading and writing skills.

Conditions

Remote work with flexible working hours; the team works virtual-first, with several hubs across three continents.

Base salary range of €28.114 - €35.143 EUR.

The actual offer may differ from this range and depends on factors such as skills, qualifications, geographic location, accomplishments, experience, credentials, internal equity and business needs.

Restricted Stock Units or Stock Options are granted based on role, seniority and location.

Everyone takes part in the company performance bonus.

The company welcomes applicants of all backgrounds and does not discriminate on protected characteristics.

Benefits

• No clocking in or out, few corporate rules and short approval chains, with the expectation of results from day one.
• The company has five values and ten key behaviors, used in hiring, onboarding, feedback and performance reviews.
• A People Development Program with internal expert workshops, and competency maps being built for selected functions.
• Access to a resident communication coach for work communication and decision-making challenges.
• Managers are encouraged to join the Leader Development Program, with feedback, coaching and check-ins.
• A $1,500 annual education budget for books, courses, certifications and similar items.
• Employee Assistance Program with counselors for non-work challenges.
• A Calm subscription for sleep and meditation.
• One extra day off each quarter on DisConnect days, taken together across the company.
• Sports, yoga and meditation activities.
• Up to 26 calendar weeks of extended parental leave for primary caregivers.
• Up to 5 paid days off each year to volunteer.
• Bloomversaries to celebrate work anniversaries.
• Interns are exempt from some benefits, usually for their first 6 months.
• A referral thank you if you know someone suited to the role.