Software Product Security Engineer

Key Responsibilities: • Security by Design: Work with product and engineering teams to design secure architectures for web-based applications and integrations. • Product Security Evaluation: Assess and implement security measures specific to AaaS and SaaS models, including encryption, data protection, and tenant isolation. • Single Sign-On and IAM: Integrate and secure authentication solutions like Single Sign-On (SSO), IAM frameworks, and third-party identity providers (e.g., Okta, Azure AD). • Web Application Security: Implement and manage security protocols such as SSL/TLS, and enforce secure practices for web headers like CORS, Content-Security-Policy, and others. • Vulnerability Management: Identify, prioritize, and remediate security vulnerabilities in the product through manual and automated methods. • Threat Modeling: Conduct threat modeling and risk assessments for product components and integrations. • Security Best Practices: Develop secure coding standards and guide engineering teams in adhering to them. • Automation: Build and maintain automation scripts for testing security configurations in CI/CD pipelines. • Monitoring and Incident Response: Collaborate with security operations to monitor and respond to security incidents related to the product. • Compliance and Documentation: Ensure the product complies with security standards such as SOC 2, ISO 27001, or PCI-DSS. Document security policies, practices, and configurations. Qualifications: Technical Skills: • Strong understanding of security for AaaS and SaaS models, including multi-tenancy and data segregation. • Experience with web application security protocols, including SSL/TLS, OAuth, SAML, and OpenID Connect. • Familiarity with IAM and SSO providers like Okta, Azure AD, or similar. • Proficiency in securing web technologies, including handling CORS, CSRF, XSS, and SQL Injectionvulnerabilities. • Hands-on experience with security tools (e.g., OWASP ZAP, Burp Suite) and DevSecOps integration into CI/CD pipelines. • Strong knowledge of secure coding practices and encryption standards. • Proficiency in scripting or programming languages such as Python, JavaScript, or Java. • Familiarity with cloud environments like AWS, Azure, or Google Cloud and their native security tools. Experience: • Proven track record of securing web-based products in a SaaS or AaaS environment. • Hands-on experience with securing product integrations, including APIs and third-party services. Soft Skills: • Strong problem-solving and analytical thinking abilities. • Excellent communication skills, with the ability to explain complex security concepts to non-technical stakeholders. • Collaborative mindset and the ability to work effectively across diverse teams. Education: Bachelor s degree in Computer Science, Cybersecurity, Software Engineering, or a related field (or equivalent experience). Experience: 3 5 years of experience in application security, software development, or product security engineering.