Product Security Engineer

Overview

Product Security Engineer role at Bugcrowd focused on partnering with engineering to build secure defaults, tune security tooling, and lead cross-functional product security projects.

What you'll do

• Partner closely with engineering to refine architecture, validate new features, and drive security investment while prioritizing engineering velocity.
• Contribute to secure defaults, libraries, and "paved roads" that eradicate entire classes of vulnerabilities rather than fixing bugs one by one.
• Tune security tooling such as SAST, DAST, SCA, and secret scanning to reduce noise and focus on what matters.
• Ensure the bug bounty program can be a model for other customers, experiment with new ways to leverage the creativity of the crowd, and provide feedback on new platform features to engineering and product.
• Lead cross-functional product security projects from scoping through delivery, influencing product and engineering roadmaps and clearly communicating risk to technical and non-technical stakeholders.
• Use code and automation to scale coverage and eliminate repetitive work, and build systems based on incentives and accountability rather than bureaucratic process.

What you'll need

• 3+ years of experience in product security, application security, or secure software development.
• Can review code, automate tasks, and build security tooling in at least one modern programming language (e.g., Python, Go, Ruby, Java).
• Hands-on experience with core application security practices: threat modeling, secure code review, and automated testing (SAST, DAST, SCA), and a solid grasp of common vulnerability classes (e.g., OWASP Top 10).
• Demonstrated ability to manage projects and influence cross-functional partners across engineering, DevOps, and product.
• Bachelor's degree in engineering, computer science or relevant field, or equivalent practical experience.

Nice to have

• Previous experience with bug bounty or vulnerability disclosure programs.
• A background in building "paved roads" or secure-by-default internal libraries to eliminate entire classes of vulnerabilities.
• Hands-on experience securing cloud-native platforms and Infrastructure as Code (e.g., Terraform, AWS, GCP, Kubernetes, Docker).
• Experience working within a fast-paced, high-growth security or SaaS company.

Details

• Location: Remote, Mexico.
• Work environment: remote, work-from-home 100% of the time.
• Physical requirements: able to remain stationary 50% of the time and carry or move a laptop as needed throughout the workday.
• Position has access to highly confidential information; background checks may be conducted.