Staff Product Security Engineer

Pilot Thomas Logistics • Boston, MA

3d

About The Position

PTC is seeking a Staff Product Security Engineer to help secure the company by providing cybersecurity expertise in the analysis, assessment, development, and evaluation of security solutions and architectures for SaaS applications, containers, operating systems, databases, and networks. The role contributes to cybersecurity requirements, security risk assessments, evaluation of security services and technologies, review and documentation of information security policies and procedures, and monitoring and oversight of security alerts.

The engineer will join PTC’s small but growing SaaS Security Team, which works collaboratively to evolve the company’s SaaS security posture in a fast, friendly, and dynamic environment. The position serves as an information security subject matter expert, guides multidisciplinary teams in implementing cybersecurity controls, and consults with internal teams on secure engineering designs and cloud-based systems. It also focuses on improving detection and remediation through automation and continually enhancing security practices, tooling, and documentation.

This position requires a U.S. citizen or Green Card holder based in the United States to meet ITAR and regulatory requirements. It is not eligible for employment-based immigration sponsorship. The anticipated annual salary range is $95,000–$140,000, with potential eligibility for a performance-based bonus, employee share purchase program, and equity programs for certain roles. Applications are accepted on an ongoing basis until the position is filled.

Requirements

• Be a U.S. citizen or Green Card holder based in the United States to meet ITAR compliance and regulatory requirements.
• Bachelor’s degree in computer science, information security, engineering, or an equivalent combination of practical experience.
• At least 5 years of experience in application security, product security, or software security engineering.
• Strong knowledge of secure software development lifecycle (SSDLC) practices.
• Hands-on experience with threat modeling, secure design reviews, and application security assessments.
• In-depth understanding of the OWASP Top 10 and OWASP API Top 10.
• Experience using SAST, DAST, SCA, and secrets-scanning tools and integrating them into CI/CD.
• Proficiency in at least one of Java, Python, JavaScript/TypeScript, or Go.
• Experience securing mobile applications, including offline data and synchronization workflows.
• Experience securing REST and event-driven APIs used by customers, partners, and internal services.
• Exposure to AI/ML security, responsible AI practices, or model risk management.
• Strong understanding of cloud platforms such as AWS, Azure, or GCP.
• Strong written and verbal communication skills and ability to partner effectively with engineering and product teams.
• Must be authorized to work in the United States without requiring current or future employment-based immigration sponsorship.

Nice To Haves

• Experience securing Salesforce-based applications, including Apex, Lightning, and the Salesforce security model.
• Experience integrating security controls into CI/CD pipelines (DevSecOps).
• Familiarity with container and Kubernetes security.
• Knowledge of OAuth 2.0, OpenID Connect (OIDC), JWT, and identity/security patterns.
• Experience with Infrastructure as Code security, including Terraform, CloudFormation, or ARM.
• Experience working in regulated or compliance-driven environments.
• Familiarity with ISO 27001, SOC 2, NIST, or FedRAMP frameworks.
• Security certifications such as GWAPT, OSWE, CSSLP, CISSP, or CCSP.

Responsibilities

• Serve as a subject matter expert on information security.
• Identify and implement new security technologies and best practices.
• Review vulnerability scan and penetration test results to identify true positives and propose remediation measures or mitigation controls.
• Drive automation of applied threat intelligence and sensor enrichment to reduce time to detect and remediate.
• Guide and influence multidisciplinary teams in implementing and operating cybersecurity controls.
• Consult with internal teams on engineering designs and cloud-based systems to ensure security is built in.
• Update and enhance security practices, tooling, and documentation.

Benefits

• Performance-based bonus eligibility.
• Employee share purchase program allowing purchase of discounted PTC stock.
• Equity program participation for certain eligible roles.
• Medical, dental, and vision insurance.
• Paid time off and sick leave.
• Tuition reimbursement.
• 401(k) contributions and employer match.
• Flexible spending accounts.
• Life insurance.
• Disability coverage.
• Commuter subsidy for office-assigned employees.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior