Product Security Engineer

Overview

Product Security Engineer role at Bugcrowd, working closely with engineering to make security a default property of the products the company builds.

What you'll do

• Partner closely with engineering to refine architecture, validate new features, and drive security investment while prioritizing engineering velocity.
• Build security paved roads: contribute to secure defaults, libraries, and paved roads that systematically eradicate entire classes of vulnerabilities rather than fixing bugs one by one.
• Create feedback loops by tuning security tooling such as SAST, DAST, SCA, and secret scanning to reduce noise and focus on what matters.
• Be the best customer of the bug bounty program, ensuring it can be a model for other customers, experimenting with new ways to leverage the creativity of the crowd, and providing feedback on new platform features to engineering and product.
• Own cross-functional product security projects end to end, from scoping through delivery, influencing product and engineering roadmaps and clearly communicating risk to technical and non-technical stakeholders.
• Amplify impact by using code and automation as a lever to scale coverage and eliminate repetitive work, building systems based on incentives and accountability rather than just bureaucratic process.

What you'll need

• 3+ years of experience in product security, application security, or secure software development.
• Can review code, automate tasks, and build security tooling in at least one modern programming language (e.g., Python, Go, Ruby, Java).
• Hands-on experience with core application security practices: threat modeling, secure code review, and automated testing (SAST, DAST, SCA), and a solid grasp of common vulnerability classes (e.g., OWASP Top 10).
• Demonstrated ability to manage projects and influence cross-functional partners across engineering, DevOps, and product.
• Bachelor's degree in engineering, computer science or relevant field, or equivalent practical experience.

Nice to have

• Previous experience with bug bounty or vulnerability disclosure programs.
• A background in building paved roads or secure-by-default internal libraries to eliminate entire classes of vulnerabilities.
• Hands-on experience securing cloud-native platforms and Infrastructure as Code (e.g., Terraform, AWS, GCP, Kubernetes, Docker).
• Experience working within a fast-paced, high-growth security or SaaS company.

Details

• Location: Remote - India.
• Work environment: remote, work-from-home 100% of the time.
• Physical requirements: able to remain stationary 50% of the time and carry or move a laptop as needed throughout the workday.
• Position has access to highly confidential, sensitive information and is subject to background checks.