Sr Product Security Engineer | Remote | Europe

REQUIREMENTS

Must-haves

• 🛡️ Product security experience: You have 5+ years of experience in product security, application security, or a closely related security engineering role in a SaaS or cloud environment.
• 🔍 Vulnerability management skills: You have hands-on experience triaging, validating, and coordinating remediation for security findings.
• 🌐 Web application security knowledge: You have a strong understanding of common web vulnerabilities and secure development principles.
• 🧰 Security tooling experience: You’ve worked with security tooling such as SAST, DAST, dependency scanning, container scanning, or similar technologies in practice.
• 🤝 Engineering partnership: You work well with product and engineering teams and know how to support them without becoming a blocker.
• ✍️ Clear communication: You can document findings, explain risks, and communicate clearly with both technical and non-technical stakeholders.
• ⚡ Pragmatic execution: You’re able to prioritize well, focus on the most meaningful risks, and make progress in fast-moving environments.
• 🏗️ Builder mindset: You’re excited by the idea of joining a newly forming security team and helping shape how the function grows over time.

Nice-to-haves

• ☁️ Cloud and platform security exposure: You have experience securing cloud-native or multi-tenant SaaS platforms.
• 🧑‍💻 JavaScript / TypeScript familiarity: You understand the security considerations of modern JavaScript or TypeScript-based application environments.
• 🔄 DevSecOps mindset: You’ve helped integrate security checks and practices into CI/CD pipelines and developer workflows.
• 🎯 Threat modeling experience: You’ve supported or facilitated threat modeling and design reviews in product teams.
• 🐞 Researcher or bug bounty exposure: You’ve worked with external researchers, bug bounty platforms, or coordinated disclosure processes before.
• 🌍 High-growth or open-source context: You’ve worked in fast-growing companies or environments with open-source, developer, or technical user communities.