we are looking for a Product Security Engineer.
Responsibilities:
Own, maintain, and continuously improve the Secure Design Review process, ensuring security considerations are integrated early in the development lifecycle.
Develop, implement, and maintain Zenitys Application Security Program, including controls, standards, developer enablement, and automation.
Manage SAST and DAST tooling, including configuration, integrations, alerting, developer workflows, and program-wide reporting.
Monitor and enforce SDLC security controls, ensuring consistent application of secure development practices across all engineering teams.
Develop and maintain Zenitys Cloud Security Program, defining guardrails, policies, and automated controls for secure-by-default cloud deployments.
Manage CSPM tooling, including configuration, findings triage, reporting, and alignment with internal risk and compliance processes.
Partner with DevOps to design, implement, and maintain a fully secured CI/CD pipeline, ensuring that security checks, guardrails, and automated gates are embedded throughout build, test, and deployment stages.
Collaborate closely with engineering teams to deliver actionable guidance, model threats, advise on architecture, and support secure implementations.
Drive automation-first approaches to product and cloud security, reducing friction and enabling fast, safe development.
Define and track KPIs, metrics, and reporting for application and cloud security health.
Identify gaps in product, application, and cloud security posture and drive end-to-end remediation plans.
Promote a culture of security and developer empowerment by delivering clear, pragmatic, and scalable guidance.
Requirements: Five (5) + years of experience in Engineering / Security Engineering
We build solutions when faced with a capability gap
Youre very comfortable with Kubernetes, Helm, and Terraform
Youre very comfortable with Python and Typescript
Three (3) + years of experience in an Application Security/Product Security focused role
Youve led AppSec focused Security Review programs
Youve led CloudSec focused Secure Design reviews
Youve led multiple vulnerability management campaigns to mitigate Cloud and Application security risks
Two (2) + years of experience managing enterprise wide security projects
You have a strong opinion on what a project plan doc should look like
Youve owned and delivered the migration or deployment of an AppSec focused security tool (SAST, DAST, ASPM, etc.)
This position is open to all candidates.