Staff Product Security Engineer

PTC•Boston, MA

4d•$95,000 - $140,000

About The Position

PTC is hiring a Staff Product Security Engineer to help secure its SaaS applications, containers, operating systems, databases, and networks. The role provides cybersecurity expertise in analyzing, assessing, developing, and evaluating security solutions and architectures. It also supports security requirements development, risk assessments, technology evaluation, information security policy and procedure reviews, and monitoring and oversight of alerts. The engineer will serve as an information security subject matter expert and work with multidisciplinary engineering and product teams to embed security in cloud-based systems. The SaaS Security Team is small and growing, with a fast, friendly, and dynamic environment where team members adapt security practices, tooling, and documentation as needed.

Requirements

Must be a U.S. citizen or Green Card holder based in the United States to meet ITAR compliance and regulatory requirements.
Bachelor's degree in computer science, Information Security, Engineering, or an equivalent combination of practical experience.
At least 5 years of experience in Application Security, Product Security, or Software Security Engineering.
Strong knowledge of Secure Software Development Lifecycle (SSDLC) practices.
Hands-on experience with threat modeling, secure design reviews, and application security assessments.
In-depth understanding of the OWASP Top 10 and OWASP API Top 10.
Experience using SAST, DAST, SCA, and secrets-scanning tools and integrating them into CI/CD.
Proficiency in at least one of Java, Python, JavaScript/TypeScript, or Go.
Experience securing mobile applications, including offline data and synchronization workflows.
Experience securing REST and event-driven APIs used by customers, partners, and internal services.
Exposure to AI/ML security, responsible AI practices, or model risk management.
Strong understanding of cloud platforms such as AWS, Azure, or GCP.
Strong written and verbal communication skills and the ability to partner effectively with engineering and product teams.
Must be authorized to work in the United States without requiring current or future employment-based immigration sponsorship.

Nice To Haves

Experience securing Salesforce-based applications, including Apex, Lightning, and the Salesforce security model.
Experience integrating security controls into CI/CD pipelines (DevSecOps).
Familiarity with container and Kubernetes security.
Knowledge of OAuth 2.0, OpenID Connect (OIDC), JWT, and identity/security patterns.
Experience with Infrastructure as Code (IaC) security, including Terraform, CloudFormation, or ARM.
Experience working in regulated or compliance-driven environments.
Familiarity with ISO 27001, SOC 2, NIST, or FedRAMP frameworks.
Security certifications such as GWAPT, OSWE, CSSLP, CISSP, or CCSP.

Responsibilities

Serve as a subject matter expert on Information Security.
Identify and implement new security technologies and best practices.
Review vulnerability scan and penetration test results for true positives and propose remediation measures or mitigation controls.
Drive automation of applied threat intelligence and sensor enrichment to reduce time-to-detect and time-to-remediate.
Guide and influence multidisciplinary teams in implementing and operating cybersecurity controls.
Consult with internal teams on engineering designs and cloud-based system development to ensure security is built in.
Update and enhance security practices, tooling, and documentation.

Benefits

Performance-based bonus eligibility
Employee share purchase program (ESPP) with the opportunity to purchase discounted PTC stock
Possible participation in equity programs for eligible roles
Medical insurance
Dental insurance
Vision insurance
Paid time off
Sick leave
Tuition reimbursement
401(k) contributions and employer match
Flexible spending accounts
Life insurance
Disability coverage
Commuter subsidy for office-assigned employees