Product Security Engineer

Stack

Responsibilities

• ▹Support PSIRT and vulnerability handling activities
• ▹Validate, triage, track, and coordinate security reports
• ▹Provide practical remediation guidance to engineering teams
• ▹Help validate security fixes and reduce product security risks
• ▹Review code, APIs, and architecture to identify security issues early
• ▹Conduct threat modeling and security design reviews
• ▹Improve security automation in engineering workflows
• ▹Support SAST, SCA, secrets scanning, and other security controls
• ▹Maintain SBOMs, dependency visibility, and remediation follow-up
• ▹Support security assessments, vulnerability assessments, and penetration testing
• ▹Maintain vulnerability handling playbooks, product security procedures, and incident response runbooks

Requirements

• ▹3+ years of experience in product security, application security, DevSecOps, or a related cybersecurity field
• ▹Strong software engineering background and ability to work effectively with engineering teams
• ▹Understanding of application, API, infrastructure, and software supply chain security risks
• ▹Experience applying cloud security concepts and practices
• ▹Understanding of IAM, network security, logging, monitoring, and secure cloud architecture patterns
• ▹Familiarity with vulnerability management, incident response, security assessments, and secure SDLC practices
• ▹Experience with threat modeling and security design reviews
• ▹Strong communication skills, including professional communication with external researchers and vendors
• ▹Ability to work independently and as part of a team in a fast-moving environment

Nice to have

• ▹Genuine interest in cybersecurity and motivation to grow as a product security expert
• ▹Hands-on experience with AWS security controls, best practices, and architecture patterns
• ▹Hands-on experience with C++ or JavaScript
• ▹Experience with security testing and automation using scripting, APIs, CI/CD pipelines, or specialized tools
• ▹Experience with threat modeling for SaaS, API, cloud, or on-prem product components
• ▹Experience with SBOM generation, dependency visibility, or software supply chain security

Soft skills

About the company

Action1 is an autonomous endpoint management platform trusted by many Fortune 500 companies, cloud-native, infinitely scalable, and free for the first 200 endpoints with no functional limits. In 2025 Action1 was recognized by Inc. 5000 as the fastest-growing private software company in America; the company is founder-led by Alex Vovk and Mike Walters, who previously founded the cybersecurity company Netwrix.