Staff AppSec – Product Security Engineer

• Leverage AI tools and methodologies to boost productivity and impact
• Contribute to building AI capabilities into internal workflows
• Advise the CISO on product security strategy across the XTM platform and lead operational implementation in product teams
• Translate security priorities into concrete actions and track technical security pains to resolution
• Lead threat modeling and security reviews for authentication and RBAC, multi-tenancy, connectors, GraphQL API, and AI and agent features
• Review critical pull requests, implement security fixes and conduct code reviews
• Build shared secure-by-default components for authorization, secrets, safe outbound calls and input handling
• Drive secure SDLC and supply-chain tooling in CI, including SAST, SCA, secret and container scanning, Renovate, Snyk, SBOMs and signed releases
• Run product vulnerability management, including community and researcher intake, bug bounty, coordinated disclosure, CVEs, advisories, remediation SLAs and product-side security incidents
• Mentor engineers, grow security champions through pairing and workshops, and document security architecture decisions
• Collaborate with R&D, platform engineering, compliance, incident and customer success teams, as well as open-source contributors and security researchers
• Report to the CISO with no direct reports

• Master degreee in computer science and or cybersecurity
• 8+ years of experience in software engineering and application or product security
• At least 3 years as the security technical reference for a SaaS or enterprise product
• Comfortable working in a remote, async-first environment
• Strong interest in AI and its applications in cybersecurity
• Comfortable leveraging AI-powered tools, including LLMs, automation and copilots
• Production coding fluency in at least two of Python, Node.js, TypeScript, Java or Rust
• In-depth knowledge of web and API security, including GraphQL, OIDC/SAML, RBAC, multi-tenant isolation, SSRF and injection
• Knowledge of CI/CD security tooling, container security and Kubernetes security
• Track record of leading cross-team security initiatives, coaching engineers and adopting standards
• Autonomy, ownership and team spirit
• Bonus: AI and LLM security, open source contributions or published CVEs, bug bounty experience, STIX 2.1 / MITRE ATT&CK, or hands-on OpenCTI/OpenAEV experience

• Competitive compensation + equity
• Remote-first flexibility
• 25 days PTO baseline
• Volunteer days
• Equipment choice and additional support for remote work and development needs
• Two annual in-person get-togethers
• Professional growth and learning opportunities
• Equal opportunity employment