Product Security Engineer

The role

Build security into YipitData's products and services with Engineering and Product teams. Do threat modeling, security design reviews, vulnerability finding, and help teams fix issues before they reach production.

What you will do

• Get involved early in new products and features using threat modeling and security design reviews
• Review application architecture, APIs, authentication, authorization, data flows, cloud services and third-party integrations
• Find and validate vulnerabilities, separate real risk from noise, and help teams prioritize
• Work with engineers to design remediation plans that protect customers without halting development
• Own and improve security tooling across the development lifecycle, including SAST, DAST, dependency scanning and secret scanning
• Tune security tools and workflows so engineers get useful findings instead of false positives
• Build automation so Product Security keeps pace with growing products, teams and use of AI
• Turn security lessons into standards, secure design patterns, coding guidance and documentation
• Help lead response to product security issues, from investigation and containment through root cause analysis and long-term remediation
• Explore emerging risks across cloud and AI-enabled products

Required qualifications

• Experience in product security, application security, software engineering, penetration testing, or a similar role
• Ability to understand complex systems, identify trust boundaries and find where real risks may be
• Ability to threat model, review architecture and assess applications without relying only on a checklist
• Ability to validate whether a vulnerability is exploitable and explain why it matters to engineers and business leaders
• Comfort working across APIs, cloud services, containers, serverless technologies and CI/CD pipelines
• Experience with SAST, DAST, dependency scanning, secret scanning or infrastructure-as-code scanning
• Ability to read and write code and automate security work using Python, JavaScript or a similar language
• Strong judgment balancing security, customer impact, engineering effort and business priorities
• Clear communication with both technical and non-technical teams

Nice to have

• Experience securing AI-enabled products, agents, large language model applications or MCP integrations
• Deep experience with identity, authentication, authorization or multi-tenant application security
• Experience applying OWASP Top 10, OWASP MCP Top 10, OWASP ASVS or NIST in real-world environments

Benefits

• Flexible work hours and flexible vacation
• Generous 401K match
• Parental leave
• Team events
• Wellness budget
• Learning reimbursement
• Growth based on impact rather than tenure

Before you apply

• Income may be subject to New York State tax withholding if the remote work is performed outside NYC offices

About the company

YipitData is a market research and analytics firm for the disruptive economy, serving investment funds and Fortune 500 companies. It has offices in the US, APAC and India, and was recognized by Inc. as a Best Workplace for three consecutive years.