Principal Product Security Engineer
- Salary
- $186.6K–$307.5K
- Hiring from
- United States
- Work type
- Remote
- Posted
623,583 remote jobs, straight from company career pages
100% free · New jobs every minute
Show job descriptionHide job description
The Principal Product Security Engineer provides assurance that every product released by Entrata meets a high security standard. This role leads security throughout the software development lifecycle, from early product design through release and ongoing operations, while helping the Product Security program evolve with emerging threats, technologies, and industry practices.
As a senior technical leader, you will partner closely with Engineering, Product, Architecture, Cloud Infrastructure, Compliance, and Security teams to identify and reduce risk, implement scalable security automation, and respond to complex security incidents and novel attack vectors.
Responsibilities
Perform security reviews, design assessments, and threat modeling across the SDLC.
Define product security standards, baseline requirements, and secure design patterns.
Partner with engineering teams to identify, remediate, and gate systemic product security risks.
Lead incident response, vulnerability investigations, and post-incident remediation.
Build automated security guardrails and CI/CD pipeline gates (SAST/DAST/Secrets).
Drive security architecture for AI/LLM integrations and cloud-native services.
Oversee supply chain security, dependency risks, SCA tooling, and SBOM governance.
Scale security culture by establishing and mentoring an engineering Security Champions program.
Manage external penetration testing, Bug Bounty programs, and vulnerability roadmaps.
Minimum Qualifications
8+ years in Product/Application Security with hands-on coding proficiency (Python, Go, Java, or Node.js).
Proven experience in threat modeling, secure SDLC, and risk-based vulnerability management.
Deep expertise securing cloud-native SaaS (AWS/GCP), containers (Docker/Kubernetes), and APIs.
Hands-on experience responding to security incidents and emerging attack techniques.
Demonstrated capability leading cross-functional engineering and product security initiatives.
Solid understanding of security baselines and standards (OWASP Top 10/LLM, NIST, SOC 2, PCI-DSS).
Strong technical communication skills to translate risks for non-technical leadership.
Preferred Qualifications
Industry certifications (CISSP, CSSLP, OSCP, or equivalent practical cybersecurity experience).
Experience working within similar-sized or larger B2B SaaS organizations.
Practical experience leveraging GenAI tools for workflow automation and AI output auditing.
AI & Operational Fluency
AI Integration: Proactively leverages company-approved GenAI tools to automate routine tasks and accelerate high-value deliverables.
Strategic Oversight: Functions as the "Human-in-the-Loop," taking full accountability for auditing AI outputs for factual accuracy, brand alignment, and the removal of hallucinations.
Data Governance: Adheres strictly to AI security protocols, ensuring no proprietary or Personally Identifiable Information (PII) data is exposed to unauthorized models.
Prompt Competency: Demonstrates the ability to craft clear, context-rich prompts to achieve consistent, high-quality results across various business domains.
