Senior Staff Product Security Engineer | Product Security Incident Response Team (PSIRT)

Description

The company's security organization builds security solutions to reduce risk and protect the company and its customers, helping customers move sensitive data and workloads to the cloud.

The role is a senior staff-level product security engineer and the senior technical authority within the Product Security Incident Response Team (PSIRT), which handles awareness, response, and investigation for vulnerabilities found after release in the company's own products and services.

You will work independently and with a team on the hardest security issues on the platform, including vulnerabilities that call for judgment beyond technical data. You will lead deep investigations, coordinate fixes across engineering, product, and release teams, and stay steady and decisive during major security events.

You should already understand product development cycles and how engineering and product work together. You will use that knowledge to carry fixes through to completion under incident pressure, and you will help shape how the company responds to product vulnerabilities at scale and raise the technical rigor of the whole response capability.

Responsibilities

• Give structure and clear decisions during major events, showing both technical and organizational leadership.
• Work with incident commanders, business security leadership, engineering, and customer-facing teams to keep ownership clear, set workstream priorities, and manage hand-offs.
• Lead coordinated response across affected releases, weighing risk against what can realistically be fixed.
• Use your knowledge of product cycles and engineering-product collaboration to move fixes through the release pipeline without getting stuck between teams.
• Check that fixes are complete and catch incomplete mitigations before release.
• Reduce the time between exposure and remediation.
• Lead the company's CVE disclosure process, including CVE assignment, scoring, advisory content, and publication timing.
• Coordinate disclosures with external security partners, vendors, and researchers, aligning timelines and messaging across all parties.
• Review external advisories, researcher write-ups, and joint disclosure content for technical accuracy before they are published.
• Represent PSIRT's technical position in multi-party disclosures and in researcher discussions.
• Write postmortems and carry lessons learned through to completion after product security incidents.
• Join retrospectives after significant product security events and turn the findings into concrete process and technical changes.
• Help partner teams track risk themes and trends across the product portfolio.
• Feed incident lessons into secure development practices and SDLC improvement work.

Requirements

• Have experience using AI in your work, or have thought carefully about how to bring it into processes, decisions, or problem solving. This can include AI tools, workflow automation, analysis of AI-driven insights, or the likely effect of AI on the function or industry.
• Have at least 12 years of related experience with a Bachelor's degree, 8 years with a Master's degree, or a PhD with 5 years of experience, or equivalent experience.
• Have at least 5 years of source code auditing for security vulnerabilities.
• Have shown leadership during major security events or incidents, and be willing to join on-call rotations.
• Be able to read and understand Java and JavaScript code.
• Understand common vulnerabilities in Java and JavaScript well.
• Script in Python and JavaScript for gathering, processing, and visualizing data.
• Build proof-of-concept exploits for web application vulnerabilities.
• Explain complex security risk clearly, in writing and verbally, to both technical teams and leadership.
• Have led fix implementation and release coordination across engineering, product, and test/release teams.
• Carry out deep product security investigations and root-cause analysis across design, code, configuration, and operations.
• Analyze exploits and build proofs of concept that show whether a risk is actually exploitable or only theoretical.
• Understand SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices.
• Have led a CVE disclosure process, including CVE assignment, CVSS scoring, and advisory publication.
• Preferred qualifications:
• Have worked in a PSIRT or similar function for a large software or SaaS platform.
• Be recognized for expertise in product security incident response, vulnerability research, or application security in software or SaaS.
• Have run vulnerability assessments on the company platform.
• Have experience with emerging threats such as AI-specific attack vectors, software supply chain security, and SDLC tooling security.
• Have experience with cloud infrastructure (AWS, Azure, GCP) and containerized environments.
• Hold relevant security certifications, such as OSWE, or show equivalent expertise.

Conditions

Base pay is $181,200 to $317,100 for positions in this location, plus equity where applicable, variable or incentive pay, and benefits. The base pay shown is a guideline, and total pay varies with qualifications, skill level, competencies, and work location.

Pay is based on the geographic location where the role sits and may change with work location.

Coverage hours are Sunday-Monday, Monday-Tuesday, and Tuesday-Wednesday 18:00 to 02:00 UTC, Friday-Saturday 19:00 to 02:00 UTC, and Saturday-Sunday 17:00 to 02:00 UTC.

Coverage may change based on incident response needs and the business. Work outside these hours may be required during significant incidents.

Work persona (flexible, remote, or required in office) is assigned by the nature of the work and work location. The company may use a third-party service to check the distance between your home and the nearest office.

Benefits

• Health plans, including flexible spending accounts.
• 401(k) plan with company match.
• ESPP.
• Matching donations.
• Flexible time away plan and family leave programs.