Software Product Security Engineer

Key Responsibilities:

• Security by Design: Work with product and engineering teams to design secure architectures for web-based applications and integrations.

• Product Security Evaluation: Assess and implement security measures specific to AaaS and SaaS models, including encryption, data protection, and tenant isolation.

• Single Sign-On and IAM: Integrate and secure authentication solutions like Single Sign-On (SSO), IAM frameworks, and third-party identity providers (e.g., Okta, Azure AD).

• Web Application Security: Implement and manage security protocols such as SSL/TLS, and enforce secure practices for web headers like CORS, Content-Security-Policy, and others.

• Vulnerability Management: Identify, prioritize, and remediate security vulnerabilities in the product through manual and automated methods.

• Threat Modeling: Conduct threat modeling and risk assessments for product components and integrations.

• Security Best Practices: Develop secure coding standards and guide engineering teams in adhering to them.

• Automation: Build and maintain automation scripts for testing security configurations in CI/CD pipelines.

• Monitoring and Incident Response: Collaborate with security operations to monitor and respond to security incidents related to the product.

• Compliance and Documentation: Ensure the product complies with security standards such as SOC 2, ISO 27001, or PCI-DSS. Document security policies, practices, and configurations.

Qualifications:

Technical Skills:

• Strong understanding of security for AaaS and SaaS models, including multi-tenancy and data segregation.

• Experience with web application security protocols, including SSL/TLS, OAuth, SAML, and OpenID Connect.

• Familiarity with IAM and SSO providers like Okta, Azure AD, or similar.

• Proficiency in securing web technologies, including handling CORS, CSRF, XSS, and SQL Injectionvulnerabilities.

• Hands-on experience with security tools (e.g., OWASP ZAP, Burp Suite) and DevSecOps integration into CI/CD pipelines.

• Strong knowledge of secure coding practices and encryption standards.

• Proficiency in scripting or programming languages such as Python, JavaScript, or Java.

• Familiarity with cloud environments like AWS, Azure, or Google Cloud and their native security tools.

Experience:

• Proven track record of securing web-based products in a SaaS or AaaS environment.

• Hands-on experience with securing product integrations, including APIs and third-party services.

Soft Skills:

• Strong problem-solving and analytical thinking abilities.

• Excellent communication skills, with the ability to explain complex security concepts to non-technical stakeholders.

• Collaborative mindset and the ability to work effectively across diverse teams.