Product Security Engineer (m./f./div.)

About this role

Responsibilities Security guidance & product lifecycle Provide security guidance on new products and technologies across the organization. Act as the security lead on development projects, embedding security throughout the product development lifecycle. Support development teams with DevSecOps practices, integrating security into CI/CD pipelines and fostering a shift-left security culture. Guide project teams through secure product lifecycle management, and provide ongoing security support to the product engineering team.

Threat modeling & security assessments Collaborate with engineering teams to perform regular product security assessments. Lead threat modeling exercises to identify and prioritize risks early in design. Application security (AppSec) Perform application security assessments and secure code reviews across web, backend, and native codebases. Operate application security tooling (SAST, DAST, SCA), configuring scans, and triaging and prioritizing findings.

Advise development teams on secure coding practices and remediation of application-layer vulnerabilities. Vulnerability testing Conduct regular vulnerability testing and scanning across current and legacy devices, products, and supporting infrastructure. Triage, prioritize, and track identified vulnerabilities through to remediation. Security tooling & automation Manage the operations and effectiveness of the product security pipeline tooling.

Tune and update tooling to reduce false positives and improve signal quality. Design and implement tools and automation to scale security processes. Cloud security Assess and help secure cloud environments (AWS), reviewing configurations, IAM policies, and infrastructure against security best practices. Support secure deployment of cloud-hosted products and services, and help embed security into infrastructure-as-code and cloud CI/CD workflows.

Incident detection & response Respond to vulnerabilities surfaced through threat detection systems. Support the incident detection and response processes. PKI & cryptography VMS Team Ovr – Product Security Engineer (mid-level) - Job Description Operate and support internal and public PKI, certificate issuance, lifecycle management, and related cryptographic services. Documentation & standards Maintain internal security documentation and standards to ensure security best practices are followed.