Senior Product Security Engineer (Loveland, CO)
About The Position
The Senior Product Security Engineer defines, implements, and enforces secure coding practices so security is embedded early throughout the product development lifecycle. The role partners with software development and cybersecurity teams to lead and enhance information security requirements, secure coding standards and language-specific guidelines, and secure SDLC methodologies. It requires expertise in secure coding, vulnerability management, and collaboration with development teams to build secure applications. The engineer leads secure services and API development, performs manual and automated code reviews and security analysis, and helps development and DevOps teams remediate vulnerabilities. The role also establishes automated security testing in CI/CD pipelines, conducts risk assessments and threat modeling, provides training and technical guidance, and ensures architecture aligns with security standards for encryption, disaster recovery, authentication, and patch management. This is an onsite role based in Loveland, Colorado.
Requirements
- Bachelor’s or master’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field.
- At least 7 years of experience in secure software development, application security, or DevSecOps.
- Hands-on experience with static, dynamic, and Software Composition Analysis (SAST/DAST/SCA) tools.
- Experience with security testing tools such as SonarQube, Checkmarx, Fortify, Veracode, Burp Suite, or similar.
- Experience communicating complex security concepts to technical, non-technical, and executive audiences.
- Hands-on experience developing and fixing code in languages such as C#, .NET, JavaScript, or TypeScript.
- Experience and knowledge working with encryption algorithms and Public-Key Infrastructure (PKI) solutions.
- Knowledge of cloud security best practices for AWS, GCP, and Azure.
- Strong knowledge of secure coding standards such as OWASP, CERT, CWE, and SANS Top 25.
- Proficiency with C#, .NET, PowerShell, TypeScript, and Azure security practices and tools, including Azure DevOps, Azure Security Center, Key Vault, Azure Policy, Azure AD, and role-based access controls.
- Understanding of Zero Trust and cloud-based and hybrid architectures.
- Hands-on knowledge of threat-modeling methodologies such as STRIDE and DREAD.
- Strong analytical and problem-solving skills and ability to work in a fast-paced agile environment.
- Fluency in English.
Nice To Haves
- Experience in a laboratory setting, veterinary clinics, healthcare, or related systems.
- Experience with container security, including Docker and Kubernetes.
- Relevant certifications such as CISSP, CSSLP, CEH, OSCP, or GIAC GWAPT.
- Microsoft Azure certifications such as AZ-500, AZ-505, AZ-400, or SC-900.
- Experience in a regulated environment involving FDA, MDR, or the EU Cyber Resilience Act and medical instrumentation.
Responsibilities
- Develop, maintain, and implement secure coding standards based on industry practices, including NIST 800-53, OWASP, CWE, CERT, and ISO.
- Develop and maintain language-specific coding standards for JavaScript, .NET, TypeScript, mobile operating-system languages, and cloud security practices.
- Lead the design, development, and maintenance of secure services and APIs using modern frameworks.
- Serve as the subject matter expert for secure coding practices.
- Integrate security principles into the SDLC and ensure compliance with security and privacy policies and standards.
- Conduct manual and automated secure code reviews and SAST, DAST, and SCA analysis to identify and remediate code vulnerabilities.
- Partner with software developers and DevOps teams to remediate vulnerabilities and improve secure coding practices.
- Provide training, mentorship, and technical guidance to developers and junior security engineers on secure coding and threat mitigation.
- Establish and manage automated security testing in CI/CD pipelines.
- Lead risk assessments and threat-modeling exercises and provide remediation guidance to product development teams globally.
- Ensure architecture aligns with security standards for encryption, disaster recovery, authentication, and patch management.
- Stay current on emerging security threats, vulnerabilities, and mitigation techniques.
Benefits
- Paid Time Off and holidays
- Medical, dental, and vision plans
- Company-paid basic life insurance and supplemental life insurance
- Company-paid short- and long-term disability
- Flexible Spending Accounts and Health Savings Accounts
- Paid parental leave
- 401(k) with company match
- Tuition and continuing education reimbursement
- Life Assistance Program
- Pet care discounts
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
