Lead Product Security Engineer
About The Position
As a Lead Product Security Engineer, you will work hands-on in product security alongside engineering teams to address complex security challenges. You will lead and execute the Secure Software Development Lifecycle (SSDLC) for Cloud Software Group on-premises and cloud products, ensuring that the software meets customer expectations for security robustness. The role includes advising product development teams on security-driven design changes, reviewing source code, analyzing crashes for exploitability, and conducting internal penetration tests. You will also identify opportunities to prevent security problems at scale and develop prototypes to address them.
Requirements
- At least 9 years of hands-on product security experience, with a strong emphasis on C/C++ development and security analysis.
- A full-time degree in Engineering; a Computer Science-related degree is preferred.
- Expertise in at least one security area: Unix systems, networking, or cryptography.
- Hands-on C and C++ programming experience and strong low-level Linux systems knowledge.
- Good knowledge of networking, including TCP/IP, HTTP/S, DNS, and related protocols.
- Debugging skills, including GDB, core dump analysis, and understanding Makefile concepts.
- Extensive knowledge of common vulnerabilities and ability to explain and remediate OWASP Top 10 vulnerabilities across multiple programming languages.
- Deep understanding of application architecture and design principles.
- Experience in design reviews and threat modeling.
- Ability to identify security vulnerabilities, perform root cause analysis, and write exploits for identified vulnerabilities.
Nice To Haves
- Experience with crash exploitability analysis tools such as GDB.
- Reverse engineering experience.
- Fuzzing experience using tools such as AFL or Peach.
- Certifications such as OSCP, OSCE, GPEN, or CRTP.
Responsibilities
- Lead and execute the Secure Software Development Lifecycle (SSDLC) for on-premises and cloud products.
- Guide product development teams on design changes that meet security requirements.
- Perform manual source code reviews, primarily in C and C++.
- Analyze crashes for exploitability and identify security vulnerabilities, using tools such as GDB.
- Conduct internal penetration tests to identify security vulnerabilities.
- Identify opportunities to prevent security problems at scale and develop prototypes to address them.
- Perform root cause analysis of security vulnerabilities and write exploits for vulnerabilities identified in relevant areas.
Benefits
- U.S.-based employees are typically offered access to healthcare, life insurance, and disability benefits.
- 401(k) plan and company match.
- Certain roles may be eligible for annual bonuses and sales incentives, depending on the applicable plan, role, and individual performance.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
