Senior Staff Product Security Engineer | Product Security Incident Response Team (PSIRT)

Description

The company's security organization builds security solutions that reduce risk and protect the company and its customers, helping customers move sensitive data and workloads to the cloud.

The company is hiring a senior staff product security engineer to act as the senior technical authority on the Product Security Incident Response Team (PSIRT), which handles awareness, response, and investigation for vulnerabilities found after release in the company's own products and services.

The role suits a recognized expert who works alone and with a team on the most significant platform security issues, especially those that need judgment beyond technical facts. You will lead deep investigations, coordinate fixes across engineering, product, and release teams, and stay calm and decisive during major security events.

You should already understand product development cycles and how engineering and product teams work together, and use that to drive fixes to completion under incident pressure. You will help shape how the company handles product vulnerabilities at scale and raise the technical rigor of the whole response function.

Responsibilities

• Provide structure and clear decisions under pressure, both technically and organizationally, during major events.
• Work with incident commanders, business security leaders, engineering, and customer-facing teams to keep ownership clear, prioritize workstreams, and manage handoffs.
• Shorten the time that vulnerabilities stay exposed.
• Coordinate the response across all affected releases, weighing risk against what is feasible to fix.
• Use your knowledge of product cycles and cross-team work to move fixes through the release pipeline without delays at team boundaries.
• Check that fixes are complete and catch incomplete mitigations before release.
• Lead the CVE and coordinated disclosure process, including CVE assignment, scoring, advisory content, and publication timing.
• Work with external security partners, vendors, and researchers on coordinated disclosures, aligning timelines and messaging.
• Review external advisories, researcher write-ups, and joint disclosure content for technical accuracy before publication.
• Represent PSIRT's technical position in multi-party disclosures and researcher discussions.
• Write postmortems and carry lessons learned through to completion after product security incidents.
• Take part in retrospectives after significant product security events and turn findings into concrete process and technical changes.
• Support partner teams tracking product security risk trends across the portfolio.
• Feed incident lessons into secure development practices and SDLC improvements.

Requirements

• Experience thinking through or applying AI in work processes, decisions, or problem solving, such as using AI tools, automating workflows, analyzing AI-driven insights, or assessing AI's impact on the function or industry.
• Minimum 12 years of related experience with a Bachelor's degree, 8 years with a Master's degree, or a PhD with 5 years, or equivalent experience.
• Minimum 5 years auditing source code for security vulnerabilities.
• Proven leadership during significant security events or major incidents, and willingness to join on-call rotations.
• Able to read and understand Java and JavaScript code.
• Solid grasp of common vulnerabilities in Java and JavaScript.
• Proficient in Python and JavaScript scripting for data collection, processing, and visualization.
• Built proof-of-concept exploits for web application vulnerabilities.
• Able to explain complex security risk clearly, in writing and verbally, to both technical staff and leadership.
• Have led fix implementation and release coordination across engineering, product, and test/release teams.
• Skilled at in-depth product security investigations and root-cause analysis across design, code, configuration, and operations.
• Able to analyze exploits and build proofs of concept that separate real exploitability from theoretical risk.
• Familiar with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices.
• Have led a CVE disclosure process, including CVE assignment, CVSS scoring, and advisory publication.
• Preferred: experience in a PSIRT or similar function for a major software or SaaS platform.
• Preferred: recognized expertise in product security incident response, vulnerability research, or application security in software or SaaS.
• Preferred: experience assessing vulnerabilities on the company platform.
• Preferred: experience with emerging threats such as AI-specific attack vectors, software supply chain security, and SDLC tooling security.
• Preferred: experience with cloud infrastructure (AWS, Azure, GCP) and containerized environments.
• Preferred: relevant security certifications, such as OSWE, or demonstrated equivalent expertise.

Conditions

Base pay for this location is $201,300 to $352,300, plus equity where applicable, variable or incentive pay, and benefits. Pay is a guideline; individual total compensation depends on qualifications, skill level, competencies, and work location, and varies by geographic location and may change.

Coverage hours: Sunday to Monday 18:00 to 02:00 UTC; Monday to Tuesday 18:00 to 02:00 UTC; Tuesday to Wednesday 18:00 to 02:00 UTC; Friday to Saturday 19:00 to 02:00 UTC; Saturday to Sunday 17:00 to 02:00 UTC.

Coverage may change based on incident response needs and the business, and extra hours outside these windows may be required for significant incidents.

Work persona (flexible, remote, or required in office) is assigned by the nature of the work and work location. The company may check your home distance from the nearest office with a third-party service to confirm eligibility.

Benefits

• Health plans, including flexible spending accounts.
• 401(k) plan with company match.
• ESPP.
• Matching donations.
• Flexible time away plan and family leave programs.