Product Security Engineer
Bugcrowd (company site, opens in a new tab)3+ yrsRemoteDirect career pageEst. 10–20 LPA
Posted 2h ago
Reach people at Bugcrowd
People at this company you can reach
Log in to see who works here
Create a free account or log in to see the people at Bugcrowd you could write to:
- Recruiters & HR
- People in this function
- Work addresses
Your match
Against your primary resume
Log in to see your match score
Create a free account or log in to unlock your CV match score across:
- Role fit
- Experience
- Industry relevance
Protocol Intelligence
How competitive this role is
Competition
Background fit
Strictness
Log in to see why each signal reads the way it does.
Job description
Structured overview of role & requirements
About This Role
- Own end-to-end product security projects, influencing engineering and product roadmaps with clear risk communication.
- Develop and maintain secure defaults, libraries, and automated security tooling (SAST, DAST, SCA, secret scanning) to reduce vulnerabilities systematically.
- Manage and improve bug bounty program and feedback loops to enhance security outcomes and team effectiveness.
Minimum Requirements
- 3+ years experience in product security, application security, or secure software development.
- Proficiency in at least one modern programming language (e.g., Python, Go, Ruby, Java) for code review, automation, and tooling development.
- Hands-on experience with threat modeling, secure code review, and automated testing tools; solid understanding of common vulnerabilities (e.g., OWASP Top 10).
- Bachelor's degree in engineering, computer science or relevant field, or equivalent practical experience.
Ideal Candidate Profile
- Experienced in managing complex security projects and collaborating with cross-functional teams like engineering, DevOps, and product management.
- Skilled in building secure-by-default internal libraries or 'paved roads' to prevent classes of vulnerabilities.
- Familiarity with cloud-native security (e.g., Kubernetes, AWS, Terraform) and participation in bug bounty or vulnerability disclosure programs is a plus.