Senior Staff Product Security Engineer | Product Security Incident Response Team (PSIRT)

Description

The company's security organization builds security solutions that reduce risk and protect the company and its customers, helping customers move sensitive data and workloads to the cloud.

The team is looking for a senior staff product security engineer to act as the lead technical authority within the Product Security Incident Response Team (PSIRT), which handles awareness, response, and investigation for vulnerabilities found after release in the company's own products and services.

The role suits a recognized expert who works both alone and within a team on the most serious platform security issues, especially those that require judgment beyond clear-cut technical data. You will run deep investigations, coordinate fixes across engineering, product, and release teams, and stay calm and decisive during major security events.

You already understand how product development cycles work and how engineering and product teams depend on each other, and you will use that to see fixes through during an incident. You will help shape how the company handles product vulnerabilities at scale and raise the technical rigor of the whole response capability.

Responsibilities

• Provide structure and clear decisions under pressure during major events, both technically and organizationally.
• Work with incident commanders, business security leaders, engineering, and customer-facing teams to keep ownership clear, set workstream priorities, and manage handoffs.
• Shorten the window of exposure.
• Coordinate the response across affected releases, weighing risk against how feasible remediation is.
• Use your knowledge of development cycles and cross-team work to move fixes through the release pipeline without getting stuck between organizations.
• Check that fixes are complete and catch partial mitigations before release.
• Lead the CVE and coordinated disclosure process, owning CVE assignment, scoring, advisory content, and publication timing.
• Coordinate disclosures with external security partners, vendors, and researchers, keeping timelines and messaging aligned across all parties.
• Review external advisories, researcher write-ups, and joint disclosure content for technical accuracy before they are published.
• Present PSIRT's technical position in multi-party disclosures and conversations with researchers.
• Write postmortems and drive the lessons learned from product security incidents to completion.
• Take part in retrospectives after major product security events and turn the findings into concrete process and technical changes.
• Help partner teams track product security risk themes and trends across the product portfolio.
• Feed lessons from incidents into secure development practices and SDLC improvement work.

Requirements

• Have experience using AI in work processes, decisions, or problem-solving, or have thought carefully about how to apply it. This can include AI tools, workflow automation, analysis of AI-generated insights, or assessing how AI affects your field or industry.
• Have at least 12 years of related experience with a Bachelor's degree, 8 years with a Master's degree, or a PhD with 5 years of experience, or equivalent experience.
• Have at least 5 years of source code auditing for security flaws.
• Have led through major security events or incidents and be willing to take part in on-call duty.
• Be able to read and understand Java and JavaScript code.
• Know the common vulnerabilities in Java and JavaScript well.
• Script in Python and JavaScript to gather, process, and visualize data.
• Build proof-of-concept exploits for web application vulnerabilities.
• Explain complex security risk clearly, in writing and out loud, to both technical staff and leadership.
• Have led fix implementation and release coordination across engineering, product, and test/release teams.
• Run deep product security investigations and root-cause analysis across design, code, configuration, and operations.
• Analyze exploits and build proofs of concept that show whether a risk is actually exploitable or only theoretical.
• Be familiar with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices.
• Have led a CVE disclosure process, including CVE assignment, CVSS scoring, and advisory publication.
• Preferred qualifications: Experience in a PSIRT or similar team for a major software or SaaS platform.
• Preferred qualifications: Recognized expertise in product security incident response, vulnerability research, or application security in software or SaaS.
• Preferred qualifications: Experience assessing vulnerabilities on the company platform.
• Preferred qualifications: Experience with emerging threats, including AI-specific attack vectors, software supply chain security, and SDLC tooling security.
• Preferred qualifications: Experience with cloud infrastructure (AWS, Azure, GCP) and containerized environments.
• Preferred qualifications: Security certifications such as OSWE, or equivalent demonstrated expertise.

Conditions

On-call coverage windows: Sunday to Monday 18:00 to 02:00 UTC; Monday to Tuesday 18:00 to 02:00 UTC; Tuesday to Wednesday 18:00 to 02:00 UTC; Friday to Saturday 19:00 to 02:00 UTC; Saturday to Sunday 17:00 to 02:00 UTC.

Coverage may change because of the nature of incident response and business needs. Extra coverage outside the stated hours may be required for major incidents.

Base pay is $201,300 to $352,300 for positions in this location, plus equity where applicable, variable or incentive compensation, and benefits. Sales roles generally use a competitive On Target Earnings (OTE) incentive structure. The base pay shown is a guideline, and total compensation varies by qualifications, skill level, competencies, and work location. Pay is based on the geographic location of the role and may change with work location.

Work personas (flexible, remote, or required in office) are assigned based on the nature of the work and the assigned work location. The company may check the distance between your primary residence and the nearest office with a third-party service to determine eligibility.

Benefits

• Health plans, including flexible spending accounts.
• 401(k) plan with company match.
• ESPP.
• Matching donations.
• Flexible time away plan and family leave programs.