Staff Product Security Engineer

Remote position only California based candidates.

Key Responsibilities:

• Own Product Security Lifecycle – Security requirements, threat modeling, risk assessments, security testing, and security documentation.
• Perform Threat Modeling – Analyze trust boundaries, data flows, attack surfaces, and abuse/misuse cases.
• Security Architecture – Design security controls for devices, applications, APIs, and cloud environments.
• Secure SDLC / DevSecOps – Implement SAST, SCA, secrets scanning, container/IaC scanning, and security gates.
• AI Security & Development – Build/develop GenAI, Agentic AI skills, agents, and services and integrate them into product development.
• Application/API Security – Hands-on with OAuth2/OIDC, authorization, IDOR, SSRF, session security, and API vulnerabilities.
• Secure Code Review – Manually review production code and triage/tune SAST findings.
• SBOM & Vulnerability Management – Manage SBOMs, VEX, dependency risks, vulnerabilities, and remediation SLAs.
• Medical Device Compliance – Support FDA cybersecurity submissions, risk assessments, SBOMs, and audit documentation.

Required Qualifications:

• 5+ years of cybersecurity/product security engineering experience.
• Strong Product Security / Secure SDLC experience, including threat modeling, risk assessment, security requirements, and security design reviews.
• Hands-on security experience across embedded/medical devices + cloud + application/API security.
• Experience with AI/GenAI/Agentic AI, including building or developing AI agents, skills, or services.
• Strong secure code review skills and ability to triage/tune SAST/SCA findings.
• Deep web/API security knowledge — OAuth2/OIDC, authorization/IDOR, SSRF, session management, API security, etc.
• SBOM & vulnerability management experience, preferably SPDX/CycloneDX and VEX/CSAF/OpenVEX.
• Experience with DevSecOps/security tools such as SAST, SCA, secrets scanning, container and IaC scanning.
• Experience in regulated product development, ideally medical devices/FDA.
• Knowledge of FDA cybersecurity requirements, ISO 14971 and IEC 62304 is highly valuable.