Product Security Engineer (Remote)

About the role

The Product Security Engineer role focuses on hands-on static analysis triage rather than security architecture, DevSecOps pipeline ownership or vulnerability program management. It suits someone who wants to apply deep static analysis expertise in a high-accountability setting where the quality of triage directly shapes how risk is understood and remediated across the product. The position is remote.

Key responsibilities

• Perform hands-on SAST triage as the primary daily activity.
• Conduct source-to-sink analysis and secure code review across real codebases.
• Disposition findings with evidence-based documentation in a regulated environment.
• Tune static analysis tools and manage false positive rates across the product portfolio.
• Partner with engineering teams to validate and drive remediation of confirmed vulnerabilities.

Required profile

• 5+ years of hands-on experience in product security, application security or software engineering with a security focus.
• Proven track record in SAST triage beyond tool integration or pipeline configuration.
• Advanced level of English.

Required skills

• Strong source-to-sink data flow analysis and secure code review skills.
• Experience operating tools such as Checkmarx, Fortify, Veracode or Coverity at the findings level.
• Ability to produce audit-traceable documentation of finding dispositions in compliance-driven environments.

What we offer

• Flexibility to choose where and how you work.
• Autonomous workflow and control of your schedule.
• Generous leave policies.
• Mentorship and development opportunities.
• A diverse and inclusive environment.