Product Security Tech Lead

Описание

This role involves driving SSDLC practices, assessing product security, conducting penetration testing, and managing bug-bounty programs for mobile games enjoyed by millions worldwide.

Responsibilities

• Drive SSDLC practices, including threat modeling, secure design reviews, security requirements, code and architecture reviews, penetration testing, and vulnerability remediation
• Assess and advise on the security of web, mobile, API, microservices, Kubernetes, and cloud-native products
• Conduct penetration testing, vulnerability management, review findings from SAST/DAST, WAF and runtime protection, and plan remediation follow-up
• Triage security findings, assess exploitability and business impact, and provide practical mitigation guidance
• Manage bug-bounty and external security-research programs, including researcher engagement and vulnerability triage
• Develop security tooling, automation, and attack-surface monitoring capabilities, and enhance the team

-s capabilities using AI tools

• Coordinate security projects and collaborate with incident response teams during product-security incidents
• Develop security training and enablement programs for R&D and security champions
• Promote continuous improvement in security practices and support technical compliance efforts related to GDPR, CCPA, and other applicable requirements

Requirements

• 5+ years of hands-on experience in application security, product security, or a closely related security engineering discipline
• Strong expertise in web application, API, mobile application, and service-to-service security
• Strong understanding of common application-security weaknesses and modern attack techniques
• Strong understanding of Kubernetes, containers, microservices, cloud environments, and CI/CD pipelines
• Experience with SSDLC, threat modeling, secure design reviews, security architecture, vulnerability remediation, and risk prioritization
• Experience with penetration testing, vulnerability management, SAST, DAST, software composition analysis, and API security testing
• Experience with external attack-surface management, runtime application protection, WAF, API gateways, service-mesh security, or cloud security
• Strong communication and stakeholder-management skills, business-enabler attitude with the ability to influence engineering teams and explain technical risk clearly
• Strong analytical, problem-solving, ownership, and people-leadership skills

Nice to have

• Experience leading or managing an application/product security team or function