Staff Application & Product Security Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Application & Product Security Engineer based in United States.

This Staff-level individual contributor role owns application and product security across both SaaS and customer-hosted products.
You will shape how security is embedded throughout the software development lifecycle, from architecture and threat modeling through release and remediation.
The role combines hands-on engineering with program ownership, allowing you to establish standards, build automated guardrails, and influence security decisions across engineering teams.
You will partner closely with Engineering, Product, Architecture, Cloud Security, and executive leadership to strengthen the security posture of shipped products.
A major focus will be vulnerability management, secure development practices, customer-facing product security, and security enablement for developers.
You will also lead emerging AI security efforts, establishing practical controls for LLM-enabled features, AI agents, and AI-assisted development workflows.
This is an opportunity to make high-impact technical decisions while creating scalable security programs, automation, and processes that support a growing product organization.

Accountabilities:

• Own and continuously mature the secure software development lifecycle, including security requirements, threat modeling, design reviews, and security controls for high-risk product changes, APIs, and integrations.
• Run and optimize SAST, SCA, secrets detection, container, and infrastructure-as-code scanning across development and CI/CD environments.
• Build reusable secure patterns, reference implementations, and policy-as-code controls that make secure development practices easier for engineering teams to adopt.
• Lead developer security enablement through Security Champions programs, training campaigns, remediation guidance, office hours, and self-service security capabilities.
• Manage application and product vulnerabilities through risk-based triage, remediation SLAs, escalations, exceptions, exploit reproduction, patch validation, and release verification.
• Own the penetration testing program, including scoping third-party engagements, performing targeted testing, coordinating remediation, and validating findings through retesting.
• Manage the Vulnerability Disclosure Program and coordinate communications with external researchers, customers, and other stakeholders through coordinated disclosure processes.
• Coordinate the CVE lifecycle for products and support product-security incident response activities.
• Own application and product-security controls within the NIST CSF 2.0 program, tracking maturity, closing gaps, and producing audit evidence.
• Establish and maintain the security posture of products across SaaS and customer-hosted environments, including secure defaults, authentication, session controls, RBAC, tenant isolation, administrative access, configuration security, and hardening guidance.
• Own the Product Security Roadmap in partnership with Product Management, Technology leadership, and Architecture, ensuring priority security capabilities are incorporated into product development.
• Serve as the technical owner for customer-facing product security, including reviewing vulnerability scans and penetration-test reports, responding to security RFIs and enhancement requests, and preparing security advisories, release notes, and hardening documentation.
• Lead threat modeling and security reviews for LLM-enabled product features, AI agents, and AI-assisted development workflows.
• Develop security controls and secure patterns addressing prompt injection, sensitive data exposure, insecure output handling, excessive agency, insecure tool integrations, and AI supply-chain risks.
• Apply and operationalize relevant AI security frameworks and guidance, including the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework.

Requirements:

• 6+ years of experience in application security, product security, or secure software engineering, including experience building or maturing an AppSec program across multiple engineering teams.
• Strong software development capabilities in an object-oriented programming language, with Java experience preferred; ability to read, debug, and write production-quality code and work across languages such as…