Senior Product Security Engineer

The role

The Product Security Engineer will support and scale product and cloud security efforts by embedding security into engineering workflows. This person will partner with engineering teams on architecture reviews, design secure solutions, and maintain security tooling.

What you will do

• Partner with product and engineering teams on architecture reviews, threat modeling, and secure design.
• Evaluate and roll out AI-assisted and agentic security workflows.
• Improve and maintain first- and third-party security tooling.
• Strengthen security controls throughout the SDLC and CI/CD pipeline.
• Serve as a GCP security subject matter expert.
• Partner with infrastructure and engineering teams to implement least-privilege IAM and security guardrails.
• Drive vulnerability management from triage through resolution.
• Coordinate penetration testing engagements.
• Help shape and scale the product security program.
• Enable engineers through documentation, guidance, training, and mentorship.

Required qualifications

• 5–7 years of experience in product security, cloud security engineering, software development or a related field.
• Practical experience applying AI and agentic workflows to security reviews, vulnerability triage, and remediation.
• Strong knowledge of Google Cloud Platform (GCP) services and security best practices.
• Hands-on experience with penetration testing coordination, threat modeling, and risk assessment.
• Proficiency in Python and cloud-native programming or scripting languages.
• Familiarity with designing and enforcing least-privilege IAM and conducting access reviews.
• Ability to communicate security risks and recommendations clearly to engineering and leadership audiences.

Benefits

• Meaningful equity
• Remote-first culture with flexibility
• Quarterly offsites
• Frequent opportunities to travel to offices
• Flexible PTO
• Comprehensive health benefits
• Parental leave

About the company

Doppel is a Series C startup building an AI-native platform for social engineering defense. The company uses agentic AI to protect brands and individuals from phishing, impersonation, and fraud.