Product Security Engineer (Loveland, CO)
About The Position
The Product Security Engineer defines, implements, and enforces secure coding practices so that software security is embedded early throughout the product development lifecycle. The role collaborates with software engineering development teams and the Cybersecurity team to lead and enhance information security requirements, including secure coding standards, language-specific guidelines, and secure SDLC methodologies. It requires expertise in secure coding standards, vulnerability management, and working with development teams to build secure applications. The position supports secure services and APIs, security integration into the SDLC, code review and vulnerability remediation, security testing automation, threat modeling, risk assessments, and alignment of application features and integrations with security requirements. The employee primarily works in a typical office environment, with possible extended hours.
Requirements
- Bachelor’s or Master’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field.
- At least 5 years of experience in secure software development, application security, or DevSecOps.
- Hands-on experience with static, dynamic, and Software Composition Analysis tools (SAST/DAST/SCA).
- Strong knowledge of secure coding standards such as OWASP, CERT, CWE, and SANS Top 25.
- Proficiency with C#, .NET, PowerShell, and TypeScript, as well as Azure security best practices and services including Azure DevOps, Azure Security Center, Key Vault, Azure Policy, Azure AD, and role-based access controls.
- Experience with security testing tools such as SonarQube, Checkmarx, Fortify, Veracode, Burp Suite, or similar tools.
- Understanding of Zero Trust, cloud-based, and hybrid architectures.
- Strong analytical and problem-solving skills and ability to work in a fast-paced agile environment.
- Ability to communicate verbally in English and communicate effectively by telephone and in person.
Nice To Haves
- Experience in regulated industries such as healthcare or petcare, applying regulations or security frameworks under a quality management process.
- Hands-on knowledge of threat modeling methodologies such as STRIDE and DREAD.
- Experience in a laboratory setting, veterinary clinics, healthcare, or related systems.
- Experience communicating complex security concepts to technical, non-technical, and executive audiences.
- Experience and knowledge working with encryption algorithms and Public-Key Infrastructure (PKI) solutions.
- Knowledge of cloud security best practices for AWS, GCP, and Azure.
- Experience with container security, including Docker and Kubernetes.
- Relevant certifications such as CISSP, CSSLP, CEH, OSCP, or GIAC GWAPT.
- Microsoft Azure certifications such as AZ-500, AZ-505, AZ-400, or SC-900.
- Experience working in an FDA, MDR, or Cyber Resiliency Act (CRA) regulated environment with medical instrumentation.
Responsibilities
- Assist in implementing and maintaining secure coding standards based on industry best practices such as NIST 800-53, OWASP, CWE, CERT, and ISO.
- Apply and promote language-specific secure coding guidelines for JavaScript, .NET, TypeScript, mobile operating system languages, and cloud-related security practices.
- Participate in the design, development, and maintenance of secure services and APIs using modern frameworks.
- Support integration of security principles into the Software Development Lifecycle and compliance with security and privacy policies and standards.
- Conduct manual and automated secure code reviews and SAST, DAST, and SCA analysis; identify and remediate vulnerabilities directly in the codebase.
- Work with software developers and DevOps teams to triage vulnerabilities, implement code-level fixes, and improve secure coding practices.
- Provide developers with technical guidance on secure coding techniques and threat mitigation.
- Support execution, maintenance, and monitoring of automated security testing tools in CI/CD pipelines.
- Participate in risk assessments and threat modeling, providing vulnerability remediation guidance to product development teams.
- Ensure application features and integrations align with security standards for encryption, disaster recovery, authentication, and patch management.
- Stay current on emerging security threats, vulnerabilities, and mitigation techniques to improve code quality.
Benefits
- Paid time off and holidays
- Medical, dental, and vision plans
- Company-paid basic life insurance and supplemental life insurance
- Company-paid short- and long-term disability
- Flexible Spending Accounts and Health Savings Accounts
- Paid parental leave
- 401(k) with company match
- Tuition and continuing education reimbursement
- Life Assistance Program
- Pet care discounts
- Industry-competitive benefits package addressing health, wellness, and financial needs
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
