Product Security Engineer

Nominal•Washington, DC

3h•Onsite

About The Position

Nominal is building a Hardware Intelligence Platform for engineers developing complex physical systems. Customers use the platform to simulate, test, manufacture, and operate systems across aerospace, defense, manufacturing, transportation, energy, and robotics. The security of the platform and its customers’ hardware-program data and controls is part of the product and must be built into architecture and maintained through every release. The Product Security Engineer will establish and own Nominal’s product security practices as a standalone function. The role combines software engineering and security work: reviewing designs, implementing and operating security gates in development pipelines, managing vulnerabilities and penetration-test remediation, and setting standards that enable engineering teams to build secure products.

Requirements

Strong software engineering background, including experience building and reviewing production services in at least one modern language.
Hands-on experience performing threat modeling and security design reviews for distributed systems or cloud-hosted services.
Experience operating application security tooling in CI/CD pipelines, such as SAST, SCA, secrets scanning, and DAST.
Experience running a vulnerability management process, including triage, prioritization based on real exploitability, and remediation tracking against SLAs.
Experience scoping penetration tests and working with testers and engineering teams to close findings.
A record of writing security standards or requirements that engineering teams adopt in practice.
Ability to lead cross-team work, make risk-based decisions amid ambiguity, and influence engineers without direct authority.

Nice To Haves

Experience securing software deployed on-premises or in air-gapped environments.
Familiarity with defense or aerospace compliance frameworks such as NIST 800-53 or NIST 800-171, or experience shipping software under ITAR or CUI constraints.
Hands-on use of software supply-chain security practices such as SBOM generation and artifact signing.
Certified Kubernetes Security Specialist (CKS) certification, or equivalent hands-on experience securing Kubernetes workloads.
Experience building a product security program from an early stage.

Responsibilities

Lead threat modeling and security design reviews for new services and features, identifying and resolving design flaws before code ships.
Architect and own SAST, SCA, and secrets-scanning gates in CI/CD pipelines, tuning them so engineers trust and act on the results.
Own the DAST program, including tool selection, coverage, and triage of findings with the teams responsible for affected services.
Run product vulnerability management, including the CVE remediation workflow and SLAs, and drive fixes across engineering teams.
Define secure SDLC standards and enable developers with practical guidance, tooling, and examples.
Scope and coordinate penetration tests and drive remediation of findings through to closure with responsible teams.
Define security requirements for customer-facing features and integrations, and mentor engineers on applying them.

Benefits

100% covered health, dental, and vision insurance for the employee and their family.
Unlimited paid vacation.
12 weeks of parental leave.
Fertility and family-planning benefit of $15,000 lifetime.
Lunch provided daily.
Wellness stipend of $100 per month.
$500 per year hardware sensor stipend.
Learning and development stipend.
401(k).
Employee-friendly equity terms.