Lead Product Security Engineer

Cloud Software Group • San Ramon, CA

21h • $168,000 - $287,280

About The Position

The Lead Product Security Engineer works hands-on in product security with engineering teams to address complex security challenges. The role leads and executes the Secure Software Development Lifecycle (SSDLC) for Cloud Software Group’s on-premises and cloud products, helping ensure software meets customer expectations for security robustness. It also guides product development teams on design changes needed to meet security requirements.

The position involves manual source code review, primarily in C and C++; crash exploitability analysis to identify security vulnerabilities; and internal penetration testing. The engineer identifies opportunities to prevent security problems at scale and develops prototypes to address them. The role requires strong product security and low-level systems expertise, vulnerability analysis and remediation skills, and experience with application architecture, design reviews, and threat modeling.

Requirements

• At least 9 years of hands-on product security experience, with an emphasis on C/C++ development and security analysis.
• Full-time degree in Engineering; Computer Science or a related field is preferred.
• Expertise in at least one of Unix systems, networking, or cryptography.
• Hands-on experience programming in C and C++, with strong low-level Linux systems knowledge.
• Good knowledge of networking, including TCP/IP, HTTP/S, DNS, and other protocols.
• Debugging skills, including GDB and core dump analysis, and understanding of Makefile concepts.
• Extensive knowledge of common vulnerabilities and the ability to explain and remediate OWASP Top 10 vulnerabilities across multiple programming languages.
• Deep understanding of application architecture and design principles.
• Experience in design reviews and threat modeling.
• Ability to identify security vulnerabilities, perform root cause analysis, and write exploits for vulnerabilities in the relevant areas.

Nice To Haves

• Crash exploitability analysis using GDB.
• Reverse engineering.
• Fuzzing using tools such as AFL or Peach.
• Certifications such as OSCP, OSCE, GPEN, or CRTP.

Responsibilities

• Lead and execute the SSDLC for Cloud Software Group on-premises and cloud products.
• Guide product development teams on design changes required by security requirements.
• Conduct manual source code reviews, primarily in C and C++.
• Analyze crashes for exploitability and security vulnerabilities, using tools such as GDB.
• Conduct internal penetration tests to identify security vulnerabilities.
• Identify opportunities to prevent security problems at scale and develop prototypes to address them.
• Identify security vulnerabilities and perform root cause analysis.
• Write exploits for vulnerabilities identified in relevant security areas.

Benefits

• Healthcare benefits for U.S.-based employees, typically offered.
• Life insurance for U.S.-based employees, typically offered.
• Disability benefits for U.S.-based employees, typically offered.
• 401(k) plan and company match for U.S.-based employees, typically offered.
• Certain roles may be eligible for an annual bonus and sales incentives, subject to applicable plan terms, role, and individual performance.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior