Staff AppSec / Product Security Engineer

The role

You will advise the CISO on product security and implement strategy across the XTM platform. You will lead threat modeling, security reviews, and secure SDLC while coding critical fixes and mentoring engineers.

What you will do

• Leverage AI tools and methodologies to boost productivity and impact
• Contribute to building AI capabilities into internal workflows
• Advise the CISO on product security strategy and lead operational implementation
• Lead threat modeling and security reviews in feature refinements
• Ensure security quality through PRs, fixes, code reviews, and shared components
• Drive secure SDLC and supply chain tooling in CI
• Run product vulnerability management including bug bounty and coordinated disclosure
• Mentor engineers and grow security champions through pairing and workshops
• Document security architecture decisions

Required qualifications

• Master degree in computer science and or cybersecurity
• 8+ years of experience in software engineering and application or product security
• At least 3 years as the security technical reference for a SaaS or enterprise product
• Write production code fluently in at least two of Python, Node.js, TypeScript, Java or Rust
• Know web and API security in depth (GraphQL, OIDC/SAML, RBAC, multi-tenant isolation, SSRF, injection)
• Knowledge of CI/CD security tooling
• Knowledge of container and Kubernetes security
• Track record of influence without authority
• Autonomy, ownership, and team spirit
• Strong interest in AI and its applications in cybersecurity
• Comfortable working with and leveraging AI-powered tools

Nice to have

• AI and LLM security (prompt injection, agent permissions)
• open source contributions or published CVEs
• bug bounty program experience
• knowledge of STIX 2.1 / MITRE ATT&CK
• hands-on use of OpenCTI or OpenAEV

Benefits

• Competitive compensation + equity
• Remote-first flexibility
• 25 days PTO baseline
• Volunteer days
• Equipment choice with additional support for remote work and development
• Two annual in-person get-togethers

About the company

Founded in 2022, Filigran is a global cybersecurity company on a mission to empower defense teams through open-source solutions. Their XTM platform brings together threat intelligence, exposure validation and cyber risk reduction.