Tessera Labs
Senior Product Security Engineer
Remote in the U.S.. Posted 24 days ago
The role
A Senior Product Security Engineer will work with developers to secure the product across its entire lifecycle. You will perform design reviews, threat modeling, penetration testing, and secure-coding partnership.
What you will do
- Partner directly with developers to secure the product across the Software Development Life Cycle (SDLC).
- Lead security design and architecture reviews, and run threat modeling on new features and services.
- Perform hands-on penetration testing of web applications and Application Programming Interfaces (APIs).
- Conduct secure code reviews and help define secure-coding standards and security acceptance criteria.
- Operate and tune Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and dependency / supply-chain scanning.
- Help engineers understand the why behind findings.
- Contribute security evidence and rigor to compliance posture like SOC 2 and ISO 27001.
Required qualifications
- Strong track record in product or application security.
- Hands-on penetration testing experience against web applications and APIs.
- Deep understanding of how modern web applications work including single-page front ends, APIs, authentication and authorization, and sessions.
- Understanding of common attack ways such as OWASP Top 10.
- Experience running security design reviews and threat modeling.
- Solid understanding of the SDLC and how to embed security into it.
- Strong communication skills to work directly with developers.
Nice to have
- Familiarity with open-source security tooling such as OWASP ZAP, Burp Suite Community Edition, Semgrep, Trivy, Grype, or Nuclei.
- A relevant offensive-security certification such as OSCP.
- Cloud security experience (Amazon Web Services, Microsoft Azure, or Google Cloud Platform) and container / Kubernetes security.
- Experience supporting a SOC 2, ISO 27001, or similar program.
- Background in enterprise or regulated environments where deployment security is non-negotiable.
About the company
tessera-labs