Product Security Engineer

Overview

Product Security Engineer role at Bugcrowd, working closely with engineering to make security a default property of what the company builds.

What you'll do

• Partner closely with engineering to refine architecture, validate new features, and drive security investment while prioritizing engineering velocity.
• Build security paved roads: contribute to secure defaults, libraries, and paved roads that systematically eradicate entire classes of vulnerabilities rather than fixing bugs one by one.
• Create feedback loops by tuning security tooling such as SAST, DAST, SCA, and secret scanning to reduce noise and focus on what matters.
• Be the best customer of the bug bounty program, modelling it for other customers, experimenting with new ways to leverage the crowd, and providing feedback on new platform features to engineering and product.
• Own cross-functional product security projects end to end, from scoping through delivery, influencing product and engineering roadmaps and communicating risk to technical and non-technical stakeholders.
• Amplify impact by using code and automation to scale coverage and eliminate repetitive work, building systems based on incentives and accountability rather than bureaucratic process.

What you'll need

• 3+ years of experience in product security, application security, or secure software development.
• Ability to review code, automate tasks, and build security tooling in at least one modern programming language (e.g., Python, Go, Ruby, Java).
• Hands-on experience with core application security practices: threat modeling, secure code review, and automated testing (SAST, DAST, SCA), and a solid grasp of common vulnerability classes (e.g., OWASP Top 10).
• Demonstrated ability to manage projects and influence cross-functional partners across engineering, DevOps, and product.
• Bachelor's degree in engineering, computer science or relevant field, or equivalent practical experience.

Nice to have

• Previous experience with bug bounty or vulnerability disclosure programs.
• A background in building paved roads or secure-by-default internal libraries to eliminate entire classes of vulnerabilities.
• Hands-on experience securing cloud-native platforms and Infrastructure as Code (e.g., Terraform, AWS, GCP, Kubernetes, Docker).
• Experience working within a fast-paced, high-growth security or SaaS company.

Details

• Remote, work-from-home 100% of the time.
• Sitting and/or standing: must be able to remain in a stationary position 50% of the time.
• Carrying and/or lifting: must be able to carry or move a laptop as needed throughout the work day.
• Role has access to highly confidential, sensitive information; background checks may be conducted.