Product Security Engineer

As a Product Security Engineer at Fluidech, you will play a crucial role in supporting fast-moving engineering teams building cloud-native web applications. Your primary focus will be to provide guardrails for security, allowing teams to move swiftly and safely. You will partner closely with engineering to enhance security across products, platform, and cloud infrastructure. Here's what you'll be working on: - **Product & Application Security:** - Perform security reviews of web/mobile apps, microservices, and APIs. - Conduct threat modelling for new and existing features. - Design and implement secure patterns in a cloud-native environment. - **Secure SDLC & DevSecOps:** - Embed security into CI/CD pipelines. - Help design and maintain security tooling. - Build reusable guardrails and developer-friendly checks. - **Application & Infrastructure Testing:** - Conduct vulnerability assessments and penetration testing. - Hunt for vulnerabilities in various components and architectures. - Develop scripts/automation for scalable bug identification. - **Cloud & Platform Security:** - Review and enhance the security of cloud accounts, IAM, network boundaries, and storage. - Collaborate to secure Kubernetes, serverless, and other PaaS components. - Define and validate baseline configurations and policies. - **Collaboration & Enablement:** - Prioritize and remediate issues with developers and tech leads. - Clearly communicate security concepts to non-security stakeholders. To be a strong fit for this role, you should: - Have hands-on product security experience with modern web application stacks deployed on AWS, GCP, or Azure. - Demonstrate a track record of identifying real-world security issues. - Be adept at discussing various technical aspects related to security. - Possess scripting skills to scale testing and validate assumptions. - Understand how to balance risk with business priorities. - Offer pragmatic solutions and collaborate effectively with engineering teams. - Show genuine interest in security, research, and problem-solving. Nice-to-have experience includes: - Prior involvement in high-performing product security teams. - Security code review experience in multiple languages. - Familiarity with Kubernetes security, secrets management, and SaaS security. - Contributions to open-source security tools, research, or responsible disclosure programs. As a Product Security Engineer at Fluidech, you will play a crucial role in supporting fast-moving engineering teams building cloud-native web applications. Your primary focus will be to provide guardrails for security, allowing teams to move swiftly and safely. You will partner closely with engineering to enhance security across products, platform, and cloud infrastructure. Here's what you'll be working on: - **Product & Application Security:** - Perform security reviews of web/mobile apps, microservices, and APIs. - Conduct threat modelling for new and existing features. - Design and implement secure patterns in a cloud-native environment. - **Secure SDLC & DevSecOps:** - Embed security into CI/CD pipelines. - Help design and maintain security tooling. - Build reusable guardrails and developer-friendly checks. - **Application & Infrastructure Testing:** - Conduct vulnerability assessments and penetration testing. - Hunt for vulnerabilities in various components and architectures. - Develop scripts/automation for scalable bug identification. - **Cloud & Platform Security:** - Review and enhance the security of cloud accounts, IAM, network boundaries, and storage. - Collaborate to secure Kubernetes, serverless, and other PaaS components. - Define and validate baseline configurations and policies. - **Collaboration & Enablement:** - Prioritize and remediate issues with developers and tech leads. - Clearly communicate security concepts to non-security stakeholders. To be a strong fit for this role, you should: - Have hands-on product security experience with modern web application stacks deployed on AWS, GCP, or Azure. - Demonstrate a track record of identifying real-world security issues. - Be adept at discussing various technical aspects related to security. - Possess scripting skills to scale testing and validate assumptions. - Understand how to balance risk with business priorities. - Offer pragmatic solutions and collaborate effectively with engineering teams. - Show genuine interest in security, research, and problem-solving. Nice-to-have experience includes: - Prior involvement in high-performing product security teams. - Security code review experience in multiple languages. - Familiarity with Kubernetes security, secrets management, and SaaS security. - Contributions to open-source security tools, research, or responsible disclosure programs.