Product Security Engineer (Loveland, CO)
About The Position
The Product Security Engineer defines, implements, and enforces secure coding practices so that software security is embedded early in the product development lifecycle. The role collaborates with software engineering development teams and Cybersecurity to lead and enhance information security requirements, including secure coding standards, language-specific guidelines, and secure SDLC methodologies. It requires expertise in secure coding standards and vulnerability management, and close collaboration with developers to build secure applications. The role supports secure services and APIs, integrates security into the software development lifecycle, conducts code reviews and security analyses, and helps teams remediate vulnerabilities. It also provides developer guidance, supports automated security testing in CI/CD pipelines, participates in risk assessments and threat modeling, and helps ensure application features and integrations meet security standards.
Requirements
- Bachelor’s or Master’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field.
- At least 5 years of experience in secure software development, application security, or DevSecOps.
- Hands-on experience with static, dynamic, and Software Composition Analysis (SAST/DAST/SCA) tools.
- Strong knowledge of secure coding standards such as OWASP, CERT, CWE, and SANS Top 25.
- Proficiency in programming languages and related tools such as C#, .NET, PowerShell, and TypeScript.
- Knowledge of Azure security best practices and tools, including Azure DevOps, Azure Security Center, Key Vault, Azure Policy, Azure AD, and role-based access controls.
- Experience with security testing tools such as SonarQube, Checkmarx, Fortify, Veracode, Burp Suite, or similar tools.
- Understanding of Zero Trust, cloud-based, and hybrid architectures.
- Strong analytical and problem-solving skills and ability to work in a fast-paced agile environment.
Nice To Haves
- Experience in regulated industries, such as healthcare or petcare, applying regulations or security frameworks under a quality management process.
- Hands-on knowledge of threat modeling methodologies such as STRIDE and DREAD.
- Experience in a laboratory setting, veterinary clinics, healthcare, or related systems.
- Experience communicating complex security concepts effectively to technical, non-technical, and executive audiences.
- Experience and knowledge working with encryption algorithms and Public-Key Infrastructure (PKI) solutions.
- Knowledge of cloud security best practices for AWS, GCP, and Azure.
- Experience with container security, including Docker and Kubernetes.
- Relevant certifications such as CISSP, CSSLP, CEH, OSCP, or GIAC GWAPT.
- Microsoft Azure certifications such as AZ-500, AZ-505, AZ-400, or SC-900.
- Experience working in a regulated environment involving FDA, MDR, or Cyber Resiliency Act (CRA) requirements and medical instrumentation.
Responsibilities
- Assist with implementing and maintaining secure coding standards based on industry practices such as NIST 800-53, OWASP, CWE, CERT, and ISO.
- Apply and promote language-specific secure coding guidelines for JavaScript, .NET, TypeScript, mobile operating system languages, and cloud security practices.
- Participate in designing, developing, and maintaining secure services and APIs using modern frameworks.
- Integrate security principles into the Software Development Lifecycle and support compliance with security and privacy policies and standards.
- Conduct manual and automated secure code reviews and SAST, DAST, and SCA analyses; identify and remediate vulnerabilities in the codebase.
- Work with software developers and DevOps teams to triage vulnerabilities, implement code-level fixes, and improve secure coding practices.
- Provide developers with technical guidance on secure coding techniques and threat mitigation.
- Support the execution, maintenance, and monitoring of automated security testing tools in CI/CD pipelines.
- Participate in risk assessments and threat modeling and provide vulnerability remediation guidance to product development teams.
- Help ensure application features and integrations align with security standards for encryption, disaster recovery, authentication, and patch management.
- Keep up to date on emerging security threats, vulnerabilities, and mitigation techniques to improve code quality.
Benefits
- Paid Time Off and holidays
- Medical, dental, and vision plans
- Company-paid basic life insurance and supplemental life insurance
- Company-paid short- and long-term disability
- Flexible Spending Accounts and Health Savings Accounts
- Paid parental leave
- 401(k) with company match
- Tuition and continuing education reimbursement
- Life Assistance Program
- Pet care discounts
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
