Описание

Silverfort is looking for a Senior Product Security Engineer to lead product security across the engineering organization, embedding security into the software development lifecycle and partnering with R&D.

Responsibilities

Lead threat modeling across products, features, and architecture changes, turning findings into actionable security requirements
Own product security tooling end-to-end (SAST, DAST, SCA, and secrets scanning) from selection and integration to tuning, triage, and remediation
Run hands-on security code and design reviews, finding vulnerabilities before they ship
Partner with R&D to secure new AI/ML features, covering prompt injection, data exposure, and model misuse
Build security guardrails and secure coding guidelines that make the secure path the easy path for R&D teams
Own vulnerability intake and CVE handling (responsible disclosure, triage, remediation, and CVE issuance), and coordinate external penetration tests through to closure
Launch and run the bug bounty program: platform selection, scope, rewards, and researcher relationships
Drive supply chain and CI/CD security: pipeline hardening, secrets management, SBOM generation, and dependency risk

Requirements

5+ years of hands-on experience in application or product security at a software company or security vendor
Deep knowledge of OWASP Top 10 and web, API, and cloud vulnerability classes, plus cryptography fundamentals (key management, TLS, hashing), with the ability to validate vulnerabilities in real code
Hands-on experience with SAST (Semgrep, Checkmarx, or similar), DAST (Burp Suite, OWASP ZAP), and SCA (Snyk, Dependabot, or Black Duck)
Practical threat modeling experience, with a track record of making it useful for engineering teams
Strong understanding of OAuth 2.0, OIDC, SAML, and JWT, and the security implications of each
Cloud-native security across AWS or Azure (workloads, containers, serverless, and IaC with Terraform) and CI/CD pipeline security, including security gates and secrets management (Vault, AWS Secrets Manager, or similar)
Python or Bash scripting for building security tooling and automating findings workflows
Hands-on use of AI coding and reasoning tools (Claude, ChatGPT, Copilot, Cursor, and similar) in real production work
Clear communication and the ability to drive remediation across engineering teams

Nice to have

CVE research, bug bounty hunting, or a track record of responsible disclosure
Offensive security background (OSCP, CTF experience, or penetration testing certifications)
Depth in identity protocols: token flows, delegated trust patterns, and identity-related attack vectors
Experience securing AI/ML features or pipelines

We offer

Joining a fast-moving team with a culture of innovation and collaboration