Sr. Staff Engineer (Product Security Incident Response)

Palo Alto Networks•Santa Clara, CA

2d•Onsite

About The Position

Our Mission At Palo Alto Networks®, we’re united by a shared mission—to protect our digital way of life. We thrive at the intersection of innovation and impact, solving real-world problems with cutting-edge technology and bold thinking. Here, everyone has a voice, and every idea counts. If you’re ready to do the most meaningful work of your career alongside people who are just as passionate as you are, you’re in the right place. Who We Are In order to be the cybersecurity partner of choice, we must trailblaze the path and shape the future of our industry. This is something our employees work at each day and is defined by our values: Disruption, Collaboration, Execution, Integrity, and Inclusion. We weave AI into the fabric of everything we do and use it to augment the impact every individual can have. If you are passionate about solving real-world problems and ideating beside the best and the brightest, we invite you to join us! We believe collaboration thrives in person. That’s why most of our teams work from the office full time, with flexibility when it’s needed. This model supports real-time problem-solving, stronger relationships, and the kind of precision that drives great outcomes. Job Summary The Team Information Security - We’re not your ordinary Information Security team. We’re a diverse group of security professionals who challenge the status quo in order to protect Palo Alto Networks and our customers. Driving innovation on the Information Security team of the fastest-growing high-tech cybersecurity company is a once-in-a-lifetime opportunity. You’ll be joined by the brightest minds in technology, and our global teams are on the front line of defense against cyberattacks. Job Summary As a Senior Staff PSIRT Engineer, you will play a critical role in protecting Palo Alto Networks products and services by leading complex vulnerability investigations. You will serve as a senior technical expert in the Product Security Incident Response Team (PSIRT), driving deep technical analysis, root cause determination, and remediation guidance. This role demands a high level of technical acumen and cross-functional collaboration to navigate sensitive situations with both internal teams and external stakeholders.

Requirements

BS or MS Degree in Computer Science, Engineering, or Cybersecurity.
4+ years of experience in product security, application security, or vulnerability research.
Strong expertise in reverse engineering, debugging, and secure software development practices.
Demonstrated ability to reproduce, analyze, and assess the exploitability of complex vulnerabilities in large-scale systems.
Deep familiarity with CVSS, CVE, and public vulnerability databases.

Nice To Haves

Experience handling responsible disclosure and coordinating with external researchers and industry partners.
Strong written and verbal communication skills, with an ability to articulate technical risk to diverse audiences.
Experience working in a fast-paced, collaborative environment with strict SLAs for vulnerability response.

Responsibilities

Lead the technical investigation of reported security vulnerabilities, including reproduction, impact analysis, and severity scoring (CVSS).
Drive root cause analysis for reported vulnerabilities and partner with product engineering teams to develop and validate remediations.
Proactively collaborate and ensure alignment with product, engineering, legal, privacy, and threat intelligence teams on vulnerability response strategies.
Engage with customers, security researchers, and industry partners to discuss vulnerability details, mitigation steps, and disclosure timelines.
Maintain deep familiarity with industry vulnerability handling standards and organizations such as CNA, NIST, and FIRST.
Contribute to the continuous improvement of PSIRT workflows, automation, and tooling to simplify and accelerate vulnerability response.
Mentor junior engineers in vulnerability research, triage, and incident response methodologies, empowering others to develop their skills.