Principal Product Security Engineer

Cribl

1d•$265,000 - $320,000•Remote

About The Position

Cribl is seeking a hands-on Principal Product Security Engineer to provide technical leadership across application, cloud, and FedRAMP environment security. The role secures Cribl’s cloud-native, customer-managed, and hybrid products as they process high-volume data for large organizations. As a remote individual contributor within Engineering, the Principal Engineer sets long-term direction across teams, resolves critical and ambiguous security problems, advises Engineering and Product leaders, and turns security requirements into secure designs, production-ready patterns, automation, and verified outcomes. The position works closely with Engineering, SRE, Cloud Operations, Compliance, and PSIRT partners to integrate regulatory commitments into product architecture and operations, while mentoring engineers and security partners. The role leads product and cloud security reviews, threat modeling, vulnerability response, security control implementation, and scalable developer security capabilities. It also leads the Product Security component of FedRAMP engineering, translating control intent into technical controls and defensible evidence. The position requires stand-by, on-call, or off-hours duties.

Requirements

Typically 10+ years of relevant software security, security engineering, or software engineering experience, or equivalent demonstrated scope and impact, including substantial hands-on Application Security or Product Security and cloud security work.
Experience securing AI or agentic systems and responsibly applying AI to security engineering workflows.
Principal-level track record of setting technical direction across teams, leading multi-quarter initiatives, resolving ambiguous critical problems, and influencing senior Engineering and Product leaders without direct authority.
Deep, hands-on AWS and Azure security experience in production SaaS or cloud-native systems, including identity and authorization, network controls, encryption and key management, secrets, logging and detection, containers or Kubernetes, serverless services, infrastructure as code, and multi-tenant data isolation.
Direct experience implementing or operating product and cloud security controls in a FedRAMP-authorized or FedRAMP-bound environment, including NIST SP 800-53 control intent, technical control implementation and evidence, continuous monitoring, vulnerability and change management, POA&M or deviation remediation, and assessor interactions.
Expertise leading security design reviews and threat models for complex applications, APIs, distributed systems, and cloud architectures, and translating findings into practical countermeasures and risk-informed release recommendations.
Strong knowledge of web and application vulnerabilities, exploit techniques, OWASP guidance, authentication and authorization protocols, cryptography, common network protocols, and secure cloud operating models.
Ability to read production code and build maintainable automation in JavaScript or TypeScript, Python, Go, or a comparable language, and willingness to work directly with Engineering to implement and verify security improvements.
Hands-on vulnerability-response experience, including exploitability analysis, root-cause and variant analysis, remediation design, fix and bypass validation, stakeholder coordination, and incident support.
Exceptional written and verbal communication skills, including the ability to explain complex risks and tradeoffs to engineers, executives, customers, assessors, and external partners.
Bachelor’s degree in computer science, cybersecurity, or a related field, or equivalent practical experience.

Nice To Haves

Experience securing enterprise data platforms, observability systems, high-volume data pipelines, agents, or customer-managed and hybrid software.
Experience with AWS GovCloud, FedRAMP Moderate or High, or NIST 800-53.
Experience building developer security platforms, secure-by-default libraries, policy-as-code, or automated guardrails across SAST, SCA, DAST, software supply chain, containers, and cloud posture.
Public security contributions such as open-source work, published research, CVE credits, standards participation, conference talks, or other demonstrated thought leadership.
Relevant credentials such as AWS Certified Security – Specialty, CISSP, CCSP, CSSLP, GIAC, or OSCP; practical impact is emphasized over certifications.

Responsibilities

Set long-term product and cloud security direction across multiple teams, including roadmaps, standards, secure-by-default patterns, and risk-informed design and release decisions.
Lead Product Security Reviews for distributed, multi-tenant SaaS and customer-managed products, including architecture and design reviews, threat modeling, abuse-case analysis, targeted secure code review, and security test planning.
Translate security risk into engineering requirements, mitigations, tests, and secure defaults; remain engaged through implementation and independently verify risk reduction.
Serve as a principal cloud security authority across IAM and workload identity, account boundaries, network exposure, encryption and key management, secrets, logging and detection, containers and Kubernetes, serverless services, infrastructure as code, hardening, and data isolation.
Lead the Product Security component of FedRAMP engineering, translating FedRAMP Moderate and NIST SP 800-53 controls into sustainable technical controls and evidence, and partnering on authorization boundaries, significant changes, continuous monitoring, vulnerability and change management, POA&M and deviation remediation, incident response, vendor assessments, and assessor interactions.
Investigate security signals and vulnerabilities from bug bounty, application and supply-chain scanners, penetration tests, cloud detections, and internal reports; assess exploitability, exposure, and impact; coordinate remediation; validate fixes and bypasses; and investigate variants and root causes.
Evolve risk-adaptive vulnerability management based on exposure, exploitability, CISA Known Exploited Vulnerabilities signals, asset criticality, customer impact, and regulatory timelines, rather than CVSS alone.
Build and operate durable security capabilities and developer paved roads across CI/CD, SAST, SCA, secrets, infrastructure as code, containers, cloud posture, and testing; automate repeatable work while preserving human judgment for consequential decisions.
Scope and oversee external penetration tests, purple-team exercises, and relevant security vendors; ensure findings result in owned and verified engineering outcomes, and provide evidence-based input to vendor and capability decisions.
Lead multi-team work through uncertainty and high-stakes situations, balancing security, reliability, delivery, customer impact, and compliance.
Communicate complex risks, options, uncertainty, and recommendations to engineers, senior leaders, customers, assessors, and external partners; represent Cribl when needed.
Mentor Product Security engineers, security champions, and engineering partners; create standards, runbooks, automation, and continuity plans.
Evaluate and responsibly apply emerging technologies, including AI-assisted security engineering, with measurable outcomes, rigorous verification, secure operating boundaries, and human accountability.
Perform stand-by, on-call, or off-hours duties.

Benefits

Health insurance
Dental insurance
Vision insurance
Short-term disability insurance
Life insurance
Paid holidays
Paid time off
Fertility treatment benefit
401(k)
Equity
Cribl Corporate Bonus Program for eligible non-sales and non-sales-adjacent roles