Senior Product Security Engineer (Loveland, CO)

ANTAGENE•Loveland, CO

4d•$141,000 - $176,000•Onsite

About The Position

The Senior Product Security Engineer defines, implements, and enforces secure coding practices so that security is embedded early throughout the product development lifecycle. The role works with Software Engineering Development Teams and Cybersecurity to lead and enhance information security requirements, secure coding standards and language-specific guidance, and secure SDLC methodologies. It requires expertise in secure coding, vulnerability management, and collaboration with development teams to build secure applications. The position is based onsite at Antech’s Loveland, Colorado office. The stated target pay range is $141,000–$176,000 annually. Pay decisions are based on factors including job-related skills, experience, education, training, and budget.

Requirements

Bachelor’s or Master’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field.
At least 7 years of experience in secure software development, application security, or DevSecOps.
Hands-on experience with static, dynamic, and Software Composition Analysis (SAST/DAST/SCA) tools.
Experience with security testing tools such as SonarQube, Checkmarx, Fortify, Veracode, or Burp Suite, or similar tools.
Experience communicating complex security concepts effectively to technical, non-technical, and executive audiences.
Hands-on experience developing and fixing code in languages such as C#, .NET, JavaScript, or TypeScript.
Experience and knowledge working with encryption algorithms and Public-Key Infrastructure (PKI) solutions.
Knowledge of cloud security best practices for AWS, GCP, and Azure.
Strong knowledge of secure coding standards such as OWASP, CERT, CWE, and SANS Top 25.
Proficiency with C#, .NET, PowerShell, TypeScript, and Azure-related security practices and tools, including Azure DevOps, Azure Security Center, Key Vault, Azure Policy, Azure AD, and role-based access controls.
Understanding of Zero Trust and cloud-based and hybrid architectures.
Hands-on knowledge of threat-modeling methodologies such as STRIDE and DREAD.
Strong analytical and problem-solving skills and ability to work in a fast-paced agile environment.
Able to perform the listed physical duties, including extensive sitting and computer use, occasional bending or crouching, and lifting, moving, or carrying up to 15 pounds.
Fluency in English.
Extended hours may be needed.

Nice To Haves

Experience in a laboratory setting, veterinary clinics, healthcare, or related systems.
Experience with container security, including Docker and Kubernetes.
Relevant certifications such as CISSP, CSSLP, CEH, OSCP, or GIAC GWAPT.
Microsoft Azure certifications such as AZ-500, AZ-505, AZ-400, or SC-900.
Experience in a regulated FDA, MDR, or EU Cyber Resilience Act environment involving medical instrumentation.

Responsibilities

Develop, maintain, and implement secure coding standards based on practices such as NIST 800-53, OWASP, CWE, CERT, and ISO.
Create and maintain language-specific secure coding guidelines for JavaScript, .NET, TypeScript, mobile operating system languages, and cloud-related security practices.
Lead the design, development, and maintenance of secure services and APIs using modern frameworks, serving as a subject matter expert in secure coding.
Integrate security principles into the Software Development Lifecycle and ensure compliance with security and privacy policies and standards.
Conduct manual and automated secure code reviews and SAST, DAST, and SCA analysis; identify and remediate vulnerabilities in the codebase.
Work with software developers and DevOps teams to remediate vulnerabilities and improve secure coding practices.
Train, mentor, and provide technical guidance to developers and junior security engineers on secure coding and threat mitigation.
Establish and manage automated security testing in CI/CD pipelines.
Lead risk assessments and threat-modeling exercises and provide vulnerability remediation guidance to product development teams globally.
Ensure architecture aligns with security standards for encryption, disaster recovery, authentication, and patch management.
Stay current on emerging security threats, vulnerabilities, and mitigation techniques.