Staff AppSec / Product Security Engineer

Description

The company is a global cybersecurity firm founded in 2022 that builds open-source tools to help defense teams act before attacks happen.

Its XTM platform (OpenCTI, OpenAEV, XTM One, XTM Hub) combines threat intelligence, exposure validation and cyber risk reduction, and is built on an open-source core.

The company is scaling worldwide and building the organization, infrastructure and capabilities for its next stage. Its CORE values are Cohesion, Openness, Responsibility and Equity.

Responsibilities

• Join the Digital Security team as a Staff AppSec / Product Security Engineer and make security a built-in part of everything shipped across the XTM platform, which serves 6,000+ organizations.
• Work daily with the R&D team, including the VP, Staff and Principal Engineers, Engineering Managers, Product Owners and the Product Manager.
• Advise the CISO on product security strategy and lead its rollout in the product teams, turning priorities into concrete actions and following security technical issues until they are closed.
• Coach engineers so they own security in their own scope, while still writing critical security fixes, reviewing PRs, pair programming and building shared secure-by-default components.
• Lead threat modeling and security reviews during feature refinement with Product Owners, covering authentication and RBAC, multi-tenancy, connectors, the GraphQL API, and AI and agent features.
• Review critical PRs and code, and build shared components for authorization, secrets, safe outbound calls and input handling.
• Tune secure SDLC and supply chain tooling in CI (SAST, SCA, secret and container scanning, Renovate, Snyk, SBOMs, signed releases) so teams trust the results.
• Manage product vulnerability handling: intake from the open-source community, researchers and bug bounty, coordinated disclosure, CVEs and advisories, remediation SLAs, and the product side of security incidents.
• Mentor engineers and grow a network of security champions through pairing, workshops and regular feedback. Record security architecture decisions so they stay consistent across teams.
• Use AI tools and methods to raise your own productivity and impact, and help build AI capabilities into internal workflows.

Requirements

• Reports to the CISO. You have no direct reports but act as the security technical reference and mentor for engineers across all teams.
• Work with Staff and Principal Engineers, Engineering Managers, Product Owners, Platform Engineering on infrastructure, compliance and incidents, and Customer Success on customer security questions and pentest findings.
• Engage with the OpenCTI and OpenAEV open-source contributors and the security researchers who report vulnerabilities.
• A master's degree in computer science and/or cybersecurity, plus 8+ years in software engineering and application or product security, including at least 3 years as the security technical reference for a SaaS or enterprise product.
• Write production code fluently in at least two of Python, Node.js, TypeScript, Java or Rust.
• Know web and API security in depth: GraphQL, OIDC/SAML, RBAC, multi-tenant isolation, SSRF and injection. Also know CI/CD security tooling and container and Kubernetes security.
• Show influence without authority: you have led a cross-team security initiative, coached engineers, and gained adoption of standards through pragmatism and clear priorities.
• Work well remote and async-first, with autonomy, ownership and a strong team spirit.
• Show strong interest in AI and its use in cybersecurity, and be comfortable using AI-powered tools such as LLMs, automation and copilots to improve your workflow.
• Bonus: AI and LLM security (prompt injection, agent permissions), open-source contributions or published CVEs, bug bounty experience, knowledge of STIX 2.1 / MITRE ATT&CK, or hands-on use of OpenCTI or OpenAEV.

Conditions

Remote-first role within a fast-growing, global team spread across Europe, North America, APJ and beyond.

Equal opportunity applies; the company welcomes applicants regardless of background.

Benefits

• Competitive compensation plus equity, so everyone shares in the company's success.
• 25 days of PTO as a baseline, and paid volunteer days for causes you care about.
• Remote-first flexibility to work from wherever you are based.
• Equipment you choose, plus extra support for remote work and development needs as programs evolve.
• Two in-person get-togethers a year: one company-wide and one for your team.
• Work on emerging technologies that combine cybersecurity, open source and AI, and help shape how they are applied in practice.
• Opportunities to expand your scope and take ownership as the company grows.