product security engineer

MongoDB

<div><p>MongoDB is seeking a Staff Product Security Engineer to lead cloud security initiatives for MongoDB Atlas and the cloud platforms that power it across AWS, GCP, and Azure. You'll be a senior individual contributor in the MongoDB Product Security organization, a diverse team responsible for the security of all customer‑facing products, including Atlas, self‑managed/server, and a broad ecosystem of related services and tools.</p>
<p>
Within Product Security, the Cloud Security team focuses specifically on Atlas control plane and data plane environments and the underlying cloud platforms, partnering closely with Atlas engineering, SRE, other security engineering teams, and global security operations to build and defend secure‑by‑default, large‑scale, multi‑tenant cloud services.</p>
<p>
We are looking to speak to candidates who are based in New York City.</p>
<h3 class="jobSectionHeader"><b>
Requirements</b></h3>
<ul><li>~10+ years of experience in application, product, and/or cloud security for large-scale, customer-facing systems</li>
<li>Deep hands-on expertise with cloud security architecture across AWS, GCP, and Azure, with experience across:</li>
<li><ul><li>VPC/networking (segmentation, egress controls, private connectivity)</li>
<li>IAM (roles, policies, workload identity, cross-account access)</li>
<li>Keys and secrets (KMS, HSMs, secret management systems)</li>
<li>Container/orchestration security (e.g., Kubernetes, ECS, serverless)</li>
<li>Multi-tenant control planes and blast-radius reduction patterns</li>
</ul></li><li>Strong track record leading complex security programs from definition through rollout and measurable impact</li>
<li>Ability to read and reason about code in languages like Go and Java or similar, and familiarity with IaC (e.g., Terraform/CloudFormation), CI/CD, and security automation tooling</li>
<li>Experience assessing and securing modern AI and ML-powered features in cloud environments, including data protection, model and prompt abuse, and responsible use of third-party AI services</li>
<li>Excellent written and verbal communication skills; you can explain complex risks and trade-offs to technical and non-technical audiences and influence without direct authority</li>
</ul><h3 class="jobSectionHeader"><b>In this role you will&hellip;</b></h3>
<p>
In this Staff Product Security Engineer role, you will:</p>
<ul>
<li><b>Own and lead Atlas cloud security initiatives</b> such as control plane hardening, cloud security baselines, IAM and customer account protection, and data-plane protections for multi-tenant environments</li>
<li><b>Translate risk and product roadmap goals into measurable workstreams</b>, defining problem statements, requirements, success metrics, and delivery plans that align with Atlas engineering and SRE priorities</li>
<li><b>Design and review large-scale cloud architectures</b>, including networking, identity, secrets management, and service-to-service access, and define secure reference architectures that can be reused across Atlas teams</li>
<li><b>Embed security into platforms and guardrails</b> by partnering with security engineering and platform teams to implement policies and automation that make secure-by-default behavior the easiest path for developers</li>
<li><b>Leverage CSPM, infrastructure vulnerability data, and IaC scanning</b> to drive concrete, prioritized hardening work in Atlas environments, with clear coverage and posture metrics</li>
<li><b>Lead assessments for Atlas features and platform changes</b>, including design reviews, threat modeling, code review, and targeted testing, with a focus on pragmatic, partner-friendly guidance</li>
<li><b>Partner with detection &amp; response, SRE, and other security teams</b> to provide product and cloud context during incidents, threat hunts, and cloud posture investigations</li>
<li><b>Mentor and level up others</b>, contributing to documentation, internal talks, and training that improve Atlas and cloud security practices across MongoDB</li>
<li>Serve as a <b>visible security leader and trusted partner</b> for Atlas engineering and SRE leadership on cloud security trade-offs and roadmap decisions</li>
</ul><h3 class="jobSectionHeader"><b>Nice to Haves</b></h3>
<ul><li>Prior experience as a <b>security lead for a multi-tenant SaaS or cloud platform</b>, particularly in data, database, or infrastructure-as-a-service domains</li>
<li>Direct experience with Atlas-like environments: control planes managing resources across multiple cloud providers, with strong isolation and blast-radius containment requirements</li>
<li>Experience driving improvements in <b>CSPM, vulnerability management, and IaC scanning</b> signal quality and developer adoption at scale</li>
<li>Public contributions to the security community (talks, tools, standards, or publications) in cloud, product, or application security</li>
<li>Experience mentoring other senior/staff engineers, or serving as a bar-raiser in interviews for product/cloud security roles</li>
</ul><h3 class="jobSectionHeader"><b>About MongoDB</b></h3>
<p>
MongoDB is built for change, empowering our customers and our people to innovate at the speed of the market. We have redefined the database for the AI era, enabling innovators to create, transform, and disrupt industries with software. MongoDB's unified database platform, the most widely available, globally distributed database on the market, helps organizations modernize legacy workloads, embrace innovation, and unleash AI. Our cloud-native platform, MongoDB Atlas, is the only globally distributed, multi-cloud database and is available across AWS, Google Cloud, and Microsoft Azure.</p>
<p>
With offices worldwide and over 60,000 customers, including 75% of the Fortune 100 and AI-native startups, relying on MongoDB for their most important applications, we're powering the next era of software.</p>
<p>
Our compass at MongoDB is our Leadership Commitment, guiding how and why we make decisions, show up for each other, and win. It's what makes us MongoDB.</p>
<p>
To drive the personal growth and business impact of our employees, we're committed to developing a supportive and enriching culture for everyone. From employee affinity groups, to fertility assistance and a generous parental leave policy, we value our employees' wellbeing and want to support them along every step of their professional and personal journeys. Learn more about what it's like to work at MongoDB, and help us make an impact on the world!</p>
<p>
MongoDB is committed to providing any necessary accommodations for individuals with disabilities within our application and interview process. To request an accommodation due to a disability, please inform your recruiter.</p>
<p>
MongoDB, Inc. provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type and makes all hiring decisions without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.</p>
<p>
Req. ID: 1273392039</p></div>

Staff Product Security Engineer, Cloud Security

VyStar Credit Union

<div><p>At VyStar, we offer competitive pay, an excellent benefit package that includes a 401(k) Plan, an extensive paid technical and on-the-job training program, and tuition reimbursement-available to all full and part time employees. Part time positions start at a minimum of 30 hours per week.</p><p></p><p>
We encourage you to become a part of VyStar Credit Union's family of employees.</p><p></p>
Associate Security Engineer &ndash; Application &amp; Product Security<p></p>
ACCOUNTABILITY STATEMENT
<br>
<br>
In support of the AVP, Application Product Security, the Application &amp; Product Security Engineer will perform various functions, including the collaboration and assurance of building processes for securing software applications and APIs, ability to create and integrate security standards through assessments, advisement, and coordinating with the AVP in consultative engagements with various business units (directly and via their technology delivery teams). Application Security focuses on partnerships with multiple product teams to drive risk reduction through a thoughtful, targeted, and collaborative model. This role will help to support the AVP in communicating security to many audiences, including business and technical leaders and individual contributors, as well as others within the Information Security Team.<p></p><p><b>
ESSENTIAL FUNCTIONS:</b></p><p></p><p>
Support Security Enablement via an Agile Method: Support multiple concurrent security integration initiatives with various business units for various development and deployment projects in offset phases within an agile framework with a dedicated staff of specialists through the requirements, design, development, and operating phases.</p><p>
Support the AVP, Application and Product Security in implementing a robust Customer Identity and Access Management (CIAM) function to ensure security and privacy aspects to registration, authentication, self-service, personalization of experience and privacy of member data is secure and meets required regulatory requirements. Specifically,</p><ul><li>
Supports scalability of platform to meet the needs of members based on product or services enablement.</li><li>
Implement required authentication and identity parameters (e.g., SSO, MFA, geo-location, etc.)</li><li>
Implement attack protection for CIAM across enterprise public-facing platforms through enablement of services such as Web Application Firewall (WAF), DDoS, Bot protections ensuring robust monitoring, alerting and actionable policies are in place to protect against external threats.</li><li>
Support program strategy for API security, mergers and acquisitions evaluations, and open-source security.</li></ul><p></p><p>
Support the AVP, Application and Product Security in the implementation of secure engineering practices such as design &amp; code reviews, API security reviews, threat modeling, penetration testing, continuous integration, and security focused behavior-driven development. Specifically:</p><ul><li>
Threat Modeling: Support threat modeling for platform/applications/services that deliveries core services to B2B and B2C customers.</li><li>
Secure Software Development: Implement and support security services and practices including static and dynamic scanning and code review, Penetration testing, open and internal sourced component lifecycle management, SDLC policies and standards.</li><li>
Support the design development, and validation of secure code of systems, solutions and processes from a security perspective and premise, hybrid and with multiple cloud providers.</li><li>
Support secure code and API interface reviews with internal and external product teams.</li><li>
Support application security continuous improvement plan and drive execution by driving best practices within teams with respect to security policies, procedures, standards, and guidelines in line with industry leading practices for on-prem, hybrid and cloud specific environments, application and product development.</li><li>
Support secure development through the CI/CD pipelines, toolchains, and operations on secure code practices.</li><li>
Perform other duties and responsibilities as assigned.</li><li><p>
Maintain and optimize existing APIs for Confidentiality, Integrity, and Availability.</p></li><li><p>
 Support secure API code reviews with internal and external product teams.</p></li><li><p>
Support secure API development through the CI/CD pipelines, toolchains, and operations on secure code practices.
</p></li><li><p>All employees and business units, as first line of defense, are expected to proactively help identify, assess, manage, and report risks within their domain of work. To enhance a healthy risk culture and support our growth for good pillar, employees will maintain vigilance in safeguarding our operations while ensuring compliance with regulatory mandates. The Risk team serves as the second line of defense by providing risk oversight and credible challenge whereas the Audit team serves as the third line of defense by providing risk assurance.</p></li></ul><p></p><p>
Incumbent is expected to demonstrate each of the following VyStar Excellence behaviors in performing the duties and responsibilities of their job:</p><ul><li>
Focus - Focus your full attention by carefully listening to and observing client or member.</li><li>
Connect - Consistently be friendly and approachable. Demonstrate your care.</li><li>
Understand - Listen empathetically and ask questions (70%/30% rule).</li><li>
Counsel - Recommend solutions based on your member&rsquo;s needs and objectives.</li><li>
Advance - Ensure that member&rsquo;s expectations were exceeded.</li><li>
Verify necessary follow-up actions.</li></ul><p></p><p><b>
JOB QUALIFICATIONS</b></p><p></p><p><b>
EDUCATION</b></p><ul><li>
High School Diploma or GED required.</li><li>
Bachelor&rsquo;s degree in Information Security, Computer Science, Information Systems, or another related field is preferred.</li></ul><p></p><p><b>
CERTIFICATIONS</b></p><ul><li>
Security+ and GSEC security certifications are preferred. Career development plan to include certifications upon hire.</li></ul><p></p><p><b>
EXPERIENCE</b></p><ul><li>
0-2+ years Information Security experience.</li><li>
0-2+ years Application/Product Security experience.</li><li>
0-2+ years API Security analyst experience.</li></ul><p></p><p><b>
KNOWLEDGE, SKILLS, &amp; ABILITIES</b></p><ul><li>
Knowledge of security offerings within one or multiple major cloud platforms (Microsoft Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), etc.) preferred.</li><li>
Knowledge of container and service-oriented security architecture for cloud-based services preferred.</li><li>
Knowledge with a modern SDLC including CI/CD pipelines, cloud architecture, API economies, and container deployment preferred.</li><li>
Knowledge of enterprise applications (support, and troubleshooting) preferred.</li><li>
Knowledge of application security tools, functions, and services similar to Snyk, Veracode, Netsparker, BurpSuite, Imperva, Radware, BugCrowd, SD Elements, OPSWAT, Okta, ThreatMetrix, and Auth0 preferred.</li><li>
 Understanding of OWASP API Security Top 10</li><li>
Demonstrated self-starter with strong analytical skills.</li><li>
Ability to manage multiple tasks simultaneously and meet established deadlines.</li><li>
Ability to collaborate with business teams on technology &amp; security-related controls, tasks, and projects.</li><li>
Ability to work productively while remote and communicate effectively in a virtual team and on location hybrid work environment.</li><li>
Ability to work within agile and waterfall project methodology.</li><li>
Ability to stay current with new technology.</li><li>
Ability to support appropriate Information Security and Technology standards to meet business requirements.</li></ul><p></p><p><b>
DISCLAIMERS AND WORK ENVIRONMENT</b></p><p></p><p>
Nothing in this position description is an implied contract for employment. The position description is intended to be an accurate account of the essential functions. The functions are not all encompassing and are subject to change at any time by management. The work environment characteristics described are representative of those that an employee encounters while performing the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. As required or requested, may exert up to 20 pounds of force occasionally and/or a negligible amount of force constantly to lift, carry, push, pull or otherwise move objects.</p><p></p><p><b>
VyStar Credit Union is not seeking outside assistance or accepting unsolicited resumes from staffing agencies or search firms for employment or contractor opportunities. Any resumes submitted by an outside vendor to any employee at VyStar via e-mail, internet, or directly to hiring managers without a valid written search agreement with the Talent Acquisition / HR department will be deemed the sole property of VyStar Credit Union.
</b></p><p></p><p><b>No placement fee will be paid if a candidate is hired as a result of the referral, or through other means.</b></p><p></p><p>
Thank you for your inquiry regarding our current job opening. Your resume will be carefully reviewed against the position requirements. Should your experience and skills match, you will be contacted by one of our Human Resources department staff members.</p><p></p><p>
Thank you again for your interest in this position!</p><p></p><p><i>
VyStar Credit Union Human Resources</i></p></div>

Associate Security Engineer – Application & Product Security

Goldman Sachs

<div>
 <strong>
  Job Description
  <br/>
  <br/>
 </strong>
 <strong>
  Role Overview
  <br/>
  <br/>
 </strong>
 The Lead Product Security Engineer position within the Asset and Wealth Management division and will be responsible for defining and evaluating solutions by closely working with the engineering teams to improve overall cybersecurity risk posture of the firm. This role is pivotal in balancing commercial objectives with robust security controls, ensuring the division's resilience against an evolving threat landscape, and protecting client assets and data.
 <br/>
 <br/>
 The objective is to foster a unified and proactive approach to risk management through early design review and penetration testing engagements with the engineering BU teams and enabling secure technological innovation across all Asset and Wealth Management initiatives.
 <br/>
 <br/>
 <strong>
  Key Responsibilities
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   This position is hands-on and requires close collaboration with Product Management, Engineering, Program Management, and Dev Ops teams.
  </li>
  <li>
   Responsible for security of applications (Cloud/Web/API/Mobile) managed by Asset and Wealth Management (AWM) in conjunction with centralized security teams
  </li>
  <li>
   Act as a security advisor to architects, developers, analysts and others to ensure we design confidentiality, integrity, resiliency, and privacy into the platform
  </li>
  <li>
   Partner with business units to understand requirements, design proposals and evaluate architectural flaws for various on-prem/cloud architectures
  </li>
  <li>
   Evaluate the effectiveness of existing key controls, identify gaps, and recommend improvements to mitigate risks and enhance firm&rsquo;s security posture
  </li>
  <li>
   Supervise, coach, and develop a small team of application security specialists
  </li>
  <li>
   Drive adoption of embedded application security controls as part of the Software Development Life Cycle (SDLC) in Agile methodology, including automated tools.
  </li>
  <li>
   Perform secure code reviews and facilitating or conducting penetration testing
  </li>
  <li>
   Assist in implementation of security related product features such authentication, cryptography, authorization, service integration, etc.
  </li>
  <li>
   Develop, maintain, and improve Technology Risk Program reflecting new emerging risks
  </li>
  <li>
   Enable the business to meet security requirements by design
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Skills And Experience Required
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   6 plus years' experience in secure architecture design, application security, and risk analysis techniques or related fields.
  </li>
  <li>
   Energetic, self-directed and self-motivated, able to build and sustain long-term relationships with colleagues.
  </li>
  <li>
   Must have experience managing multiple tasks and using sound judgment when managing risks, prioritizing and escalating.
  </li>
  <li>
   Must be able to work with deeply technical engineers, identify gaps that need addressing, and hold them to account.
  </li>
  <li>
   Security testing methodologies, tools and techniques - understanding of common application security vulnerabilities and controls to remediate.
  </li>
  <li>
   Expert knowledge of application security best practices including OWASP and CWE and cloud related concepts
  </li>
  <li>
   Hands-on software development and/or application Penetration Testing experience in complex environments an advantage
  </li>
  <li>
   The successful candidate will be able to balance project management trade-offs, own decisions and communicate effectively with senior stakeholders across business, partners, vendors, internal technology stakeholders and technology peers, with an eye towards influencing and driving positive business outcomes.
  </li>
  <li>
   Strong desire to learn and contribute solutions and ideas to a broad team.
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Preferred Qualifications
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Experienced in Financial Services/Fintech
  </li>
  <li>
   BS or MS degree in Computer Science, Cyber Security, Information Security, or a related technical field.
  </li>
  <li>
   Experience with leveraging AI/ML to solve security problems and scale operations.
  </li>
  <li>
   Knowledge of secure coding languages (e.g., Python, Java, Go).
  </li>
  <li>
   Cloud related experiences
  </li>
  <li>
   CSSLP / CISSP / CCSP / OSCP is a plus
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  About Goldman Sachs
  <br/>
  <br/>
 </strong>
 At Goldman Sachs, we commit our people, capital and ideas to help our clients, shareholders and the communities we serve to grow. Founded in 1869, we are a leading global investment banking, securities and investment management firm. Headquartered in New York, we maintain offices around the world.
 <br/>
 <br/>
 We believe who you are makes you better at what you do. We're committed to fostering and advancing diversity and inclusion in our own workplace and beyond by ensuring every individual within our firm has a number of opportunities to grow professionally and personally, from our training and development opportunities and firmwide networks to benefits, wellness and personal finance offerings and mindfulness programs. Learn more about our culture, benefits, and people at GS.com/careers.
 <br/>
 <br/>
 We&rsquo;re committed to finding reasonable accommodations for candidates with special needs or disabilities during our recruiting process. Learn more: https://www.goldmansachs.com/careers/footer/disability-statement.html
 <br/>
 <br/>
 &copy; The Goldman Sachs Group, Inc., 2023. All rights reserved.
 <br/>
 <br/>
 Goldman Sachs is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, national origin, age, veterans status, disability, or any other characteristic protected by applicable law.
</div>


Asset & Wealth Management - Doha - Vice President - Security Engineering

<div><div><div><div><div><div><div><p><b>Role Overview</b></p>
<p>
The Lead Product Security Engineer position within the Asset and Wealth Management division and will be responsible for defining and evaluating solutions by closely working with the engineering teams to improve overall cybersecurity risk posture of the firm. This role is pivotal in balancing commercial objectives with robust security controls, ensuring the division's resilience against an evolving threat landscape, and protecting client assets and data.</p>
<p>
The objective is to foster a unified and proactive approach to risk management through early design review and penetration testing engagements with the engineering BU teams and enabling secure technological innovation across all Asset and Wealth Management initiatives.</p><br>
<p></p>
<p><b>
Key Responsibilities</b></p>
<ul><li>
This position is hands-on and requires close collaboration with Product Management, Engineering, Program Management, and Dev Ops teams.</li><li>
Responsible for security of applications (Cloud/Web/API/Mobile) managed by Asset and Wealth Management (AWM) in conjunction with centralized security teams</li><li>
Act as a security advisor to architects, developers, analysts and others to ensure we design confidentiality, integrity, resiliency, and privacy into the platform</li><li>
Partner with business units to understand requirements, design proposals and evaluate architectural flaws for various on-prem/cloud architectures</li><li>
Evaluate the effectiveness of existing key controls, identify gaps, and recommend improvements to mitigate risks and enhance firm&rsquo;s security posture</li><li>
Supervise, coach, and develop a small team of application security specialists</li><li>
Drive adoption of embedded application security controls as part of the Software Development Life Cycle (SDLC) in Agile methodology, including automated tools.</li><li>
Perform secure code reviews and facilitating or conducting penetration testing</li><li>
Assist in implementation of security related product features such authentication, cryptography, authorization, service integration, etc.</li><li>
Develop, maintain, and improve Technology Risk Program reflecting new emerging risks</li><li>
Enable the business to meet security requirements by design</li></ul><br>
<p></p>
<p><b>
Skills and Experience Required</b></p>
<ul><li>
6 plus years' experience in secure architecture design, application security, and risk analysis techniques or related fields.</li><li>
Energetic, self-directed and self-motivated, able to build and sustain long-term relationships with colleagues.</li><li>
Must have experience managing multiple tasks and using sound judgment when managing risks, prioritizing and escalating.</li><li>
Must be able to work with deeply technical engineers, identify gaps that need addressing, and hold them to account.</li><li>
Security testing methodologies, tools and techniques - understanding of common application security vulnerabilities and controls to remediate.</li><li>
Expert knowledge of application security best practices including OWASP and CWE and cloud related concepts</li><li>
Hands-on software development and/or application Penetration Testing experience in complex environments an advantage</li><li>
The successful candidate will be able to balance project management trade-offs, own decisions and communicate effectively with senior stakeholders across business, partners, vendors, internal technology stakeholders and technology peers, with an eye towards influencing and driving positive business outcomes.</li><li>
Strong desire to learn and contribute solutions and ideas to a broad team.</li></ul><br>
<p></p>
<p><b>
Preferred Qualifications</b></p>
<ul><li>
Experienced in Financial Services/Fintech</li><li>
BS or MS degree in Computer Science, Cyber Security, Information Security, or a related technical field.</li><li>
Experience with leveraging AI/ML to solve security problems and scale operations.</li><li>
Knowledge of secure coding languages (e.g., Python, Java, Go).</li><li>
Cloud related experiences</li><li>
CSSLP / CISSP / CCSP / OSCP is a plus</li></ul><br>
<p></p>
<p><b>
ABOUT GOLDMAN SACHS</b></p>
<p>
At Goldman Sachs, we commit our people, capital and ideas to help our clients, shareholders and the communities we serve to grow. Founded in 1869, we are a leading global investment banking, securities and investment management firm. Headquartered in New York, we maintain offices around the world.</p>
<p>
We believe who you are makes you better at what you do. We're committed to fostering and advancing diversity and inclusion in our own workplace and beyond by ensuring every individual within our firm has a number of opportunities to grow professionally and personally, from our training and development opportunities and firmwide networks to benefits, wellness and personal finance offerings and mindfulness programs. about our culture, benefits, and people at GS.com/careers.</p>
<p>
We&rsquo;re committed to finding reasonable accommodations for candidates with special needs or disabilities during our recruiting process. : https://www.goldmansachs.com/careers/footer/disability-statement.html</p>
<p>
&copy; The Goldman Sachs Group, Inc., 2023. All rights reserved.<br>
<br>
Goldman Sachs is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, national origin, age, veterans status, disability, or any other characteristic protected by applicable law.</p></div></div></div></div></div></div><div><div><div><div><div><b>
We Offer Best-In-Class Benefits</b></div></div></div><p></p><div><div><div><div><div><div><div>
Healthcare &amp; Medical Insurance</div></div><p>
We offer a wide range of health and welfare programs that vary depending on office location. These generally include medical, dental, short-term disability, long-term disability, life, accidental death, labor accident and business travel accident insurance.</p></div></div></div></div><p></p><div><div><div><div><div><div>
Holiday &amp; Vacation Policies</div></div><p>
We offer competitive vacation policies based on employee level and office location. We promote time off from work to recharge by providing generous vacation entitlements and a minimum of three weeks expected vacation usage each year.</p></div></div></div></div><p></p><div><div><div><div><div><div>
Financial Wellness &amp; Retirement</div></div><p>
We assist employees in saving and planning for retirement, offer financial support for higher education, and provide a number of benefits to help employees prepare for the unexpected. We offer live financial education and content on a variety of topics to address the spectrum of employees&rsquo; priorities.</p></div></div></div></div><p></p><div><div><div><div><div><div>
Health Services</div></div><p>
We offer a medical advocacy service for employees and family members facing critical health situations, and counseling and referral services through the Employee Assistance Program (EAP). We provide Global Medical, Security and Travel Assistance and a Workplace Ergonomics Program. We also offer state-of-the-art on-site health centers in certain offices.</p></div></div></div></div><p></p><div><div><div><div><div><div>
Fitness</div></div><p>
To encourage employees to live a healthy and active lifestyle, some of our offices feature on-site fitness centers. For eligible employees we typically reimburse fees paid for a fitness club membership or activity (up to a pre-approved amount).</p></div></div></div></div><p></p><div><div><div><div><div><div>
Child Care &amp; Family Care</div></div><p>
We offer on-site child care centers that provide full-time and emergency back-up care, as well as mother and baby rooms and homework rooms. In every office, we provide advice and counseling services, expectant parent resources and transitional programs for parents returning from parental leave. Adoption, surrogacy, egg donation and egg retrieval stipends are also available.</p></div></div></div></div><p></p><div><div><div><div><div><div>
Benefits at Goldman Sachs</div></div><p>
Read more about the full suite of class-leading benefits our firm has to offer.</p></div></div></div></div></div></div></div></div><div></div>
<br><p>Opportunity Overview
CORPORATE TITLE
Vice President
OFFICE LOCATION(S)
Doha
JOB FUNCTION
Security Engineering
DIVISION
Asset &amp; Wealth Management</p>

Xbow

<div><h2 class="jobSectionHeader"><b>About XBOW</b></h2><p>
At XBOW, we&rsquo;re redefining the future of cybersecurity by building the world's first autonomous pentester, powered by AI. Today, the gold standard for securing software systems is human pentesters, but with the rise of artificial intelligence, we&rsquo;re stepping up to scale offensive security to meet the ever-growing demand.</p><p>
AI is transforming the landscape of both cybersecurity and cyberattacks. While millions of people without security expertise are creating software, bad actors are using AI to launch more effective attacks. XBOW fights back with AI-driven superpowers, enabling security teams to stay one step ahead.</p><p>
Backed by Sequoia Capital and Altimeter, and a team that includes the creators of GitHub Copilot and GitHub Advanced Security, XBOW is not just keeping up with the times&mdash;we&rsquo;re shaping the future of cybersecurity. Our mission is simple: to defeat the bad actors before they strike, using AI to revolutionize how we approach offensive security.</p><p>
We&rsquo;re building something that must be built, and we&rsquo;re the team to do it. Join us in shaping the next frontier of autonomous security.</p><p></p><h2 class="jobSectionHeader"><b>
Your Role</b></h2><p>
We're looking for an experienced, hands-on Security Engineer to secure XBOW's product, cloud, and platform as we scale. This is a technical individual contributor role focused on building security into how we design, ship, and operate systems.</p><p>
You'll work closely with engineering and platform teams across application security, cloud security, vulnerability management, and incident response. The core of this role is security engineering ownership: improving preventive controls, detection quality, and response readiness, while driving remediation of real risks in production.</p><p></p><h2 class="jobSectionHeader"><b>
What You&rsquo;ll Do</b></h2><ul><li><p>
Design and implement security controls across cloud, infrastructure, and internal platforms</p></li><li><p>
Partner with engineering to harden cloud architecture, IAM, and infrastructure</p></li><li><p>
Own product security reviews for new features, services, and major architecture changes</p></li><li><p>
Drive threat modeling and secure design decisions early in the SDLC</p></li><li><p>
Operate and improve AppSec workflows (SAST, SCA, secrets scanning, IaC scanning)</p></li><li><p>
Triage vulnerabilities across application, container, and cloud findings, and drive remediation with risk-based SLAs</p></li><li><p>
Define and run the vulnerability management lifecycle: intake, prioritization, exception handling, validation, and reporting</p></li><li><p>
Improve CNAPP coverage and finding quality across cloud accounts and workloads</p></li><li><p>
Improve Kubernetes and container security posture</p></li><li><p>
Monitor, investigate, and respond to security events and incidents</p></li><li><p>
Build automation to improve security operations, access workflows, and incident response</p></li><li><p>
Support the compliance function by implementing and maintaining technical controls for SOC 2 and ISO 27001, and by documenting security processes, playbooks, and policies that scale with the company.</p></li><li><p>
Support the IT team with timezone coverage for core operational security tasks, including SaaS administration (Okta, Google Workspace, 1Password), onboarding/offboarding workflows, and endpoint access management (MDM, VPN, and secure device provisioning) for a fully remote team.</p></li></ul><p></p><h2 class="jobSectionHeader"><b>
Who You Are</b></h2><ul><li><p>
5+ years of experience in security engineering, product security, cloud/platform security, or closely related roles</p></li><li><p>
Strong hands-on experience securing cloud environments (AWS and Azure)</p></li><li><p>
Comfortable owning technical security problems end-to-end in fast-moving environments</p></li><li><p>
Hands-on experience with product/application security in engineering environments (secure design reviews, threat modeling, code-level risk discussions)</p></li><li><p>
Experience operating AppSec tooling and processes at scale (SAST, SCA, secrets, IaC scanning)</p></li><li><p>
Strong vulnerability triage and remediation management experience, including risk-based prioritization and SLAs</p></li><li><p>
Experience with CNAPP (or equivalent cloud security platforms) and tuning findings for engineering actionability</p></li><li><p>
Working knowledge of Kubernetes/container security in production systems</p></li><li><p>
Ability to partner with developers and platform teams to ship secure defaults without blocking delivery</p></li><li><p>
Comfortable writing scripts and automations to improve security reliability and scale</p></li><li><p>
Experience in incident response, investigation, and post-incident hardening in cloud-native environments</p></li><li><p>
Familiar with SOC 2 requirements and comfortable implementing technical controls to support compliance</p></li><li><p>
Security-minded, detail-oriented, and a proactive communicator in remote-first teams</p></li></ul><p></p><h2 class="jobSectionHeader"><b>
Bonus if you have</b></h2><ul><li><p>
Multi-cloud experience beyond AWS (e.g., Azure/GCP/OCI)</p></li><li><p>
Offensive security/pentesting background and ability to convert findings into durable engineering fixes</p></li><li><p>
Experience scaling security at a startup from early stage to audit-ready maturity</p></li><li><p>
Relevant security certifications (e.g., OSCP, OSCE, AWS Security Specialty, Kubernetes security certs)</p></li><li><p>
Proficient with identity and access systems (Okta, Google Workspace, cloud IAM) and access lifecycle management</p></li></ul><p></p><h2 class="jobSectionHeader"><b>
What We Offer:</b></h2><ul><li><p><b>
Compensation &amp; Equity</b>: Competitive salary, clear performance-based incentives, and equity package, making you an integral part of XBOW&rsquo;s growth story.</p></li><li><p><b>
Career Growth</b>: Significant opportunities to progress within the sales organization and shape your career trajectory as we scale.</p></li><li><p><b>
Meaningful Work</b>: You&rsquo;ll directly impact XBOW&rsquo;s mission to revolutionize cybersecurity and protect organizations worldwide.</p></li></ul><p></p><h2 class="jobSectionHeader"><b>
What Else You Should Know</b></h2><ul><li><p><b>
Location</b>: Remote US</p></li><li><p><b>
Contract</b>: Full-time</p></li><li><p><b>
Hiring Process</b>:</p><ul><li><p>
Introduction with Talent</p></li><li><p>
Hiring Manager Interview</p></li><li><p>
Technical Interview</p></li><li><p>
Final Interview with Head of Department</p></li></ul></li></ul><p>
At XBOW, we leverage AI every day, it's embedded in our product and our sales approach. But for this role, we&rsquo;re seeking someone who brings genuine curiosity, empathy, and persistence. If that's you, we'd love to connect.</p><p>
Compensation Range: $140K - $180K</p></div>

Security Engineer

Teal Drones

<div><h2 class="jobSectionHeader"><b>Position Summary</b></h2><p></p><p>
Teal Drones is seeking an experienced Platform Security Engineer to own and mature our end-to-end software security posture across embedded Linux drone platforms, CI/CD infrastructure, and government cloud environments.
</p><p>This role is the primary security authority responsible for threat modeling, vulnerability management, hardened firmware builds, secrets governance, and compliance assessments including Blue List / DoD evaluations.
</p><p>You will collaborate directly with embedded firmware engineers, DevOps, various customers and platform teams to embed security into every layer of the software development lifecycle. This role also includes many hands-on engineering duties.</p><p></p><h2 class="jobSectionHeader"><b>
Essential Duties and Responsibilities</b></h2><p></p><p><b>
Embedded Linux Platform &amp; Firmware Security</b></p><ul><li>
Design, implement and enforce hardening standards for Ubuntu-based embedded Linux firmware running on Qualcomm QRB5165/8550 and similar SoC platforms.</li><li>
Own the process and conduct hands-on activities of auditing, patching, and validating OS-level security updates (e.g., Ubuntu ESM, CVE triage) for offline-deployable drone firmware images.</li><li>
Identify and eliminate unnecessary services and open from production firmware builds to reduce attack surface during compliance assessments.</li><li>
Develop, author and maintain BitBake/Yocto security recipes and patches for Qualcomm BSP layers, ensuring build-time application of security hardening.</li></ul><p><b>
Software Build Pipeline Security</b></p><ul><li>
Secure CI/CD pipelines, including build isolation, artifact integrity, and protection against race conditions and cross-job artifact contamination.</li><li>
Enforce code signing, reproducible builds, and chain-of-custody controls for firmware artifacts distributed via internal Apache/S3 infrastructure.</li><li>
Implement and audit role-based access controls across SCM and build systems.</li><li>
Define and enforce branch protection policies, merge request security gates, and automated SAST/SCA scanning in CI pipelines.</li></ul><p><b>
Secrets Management &amp; Cryptography</b></p><ul><li>
Lead, design and implement a secrets management strategy across build servers, embedded devices, and cloud infrastructure (e.g., HashiCorp Vault, AWS Secrets Manager).</li><li>
Govern cryptographic key lifecycle: RSA key generation, rotation, storage, and revocation for firmware signing, device authentication, and secure comms.</li><li>
Eliminate hardcoded credentials and insecure secret injection patterns across build scripts, Dockerfiles, and configuration files.</li><li>
Implement challenge-response and hardware-rooted authentication mechanisms for embedded device access control.</li></ul><p><b>
Government Cloud &amp; Compliance Security</b></p><ul><li>
Guide and build architecture and security controls for GovCloud (AWS GovCloud, Azure Government) deployments, ensuring alignment with FedRAMP, NIST SP 800-171, CMMC, and DoD IL requirements.</li><li>
Hands-on respond to Nessus/vulnerability scanner findings (e.g., open port documentation, service inventory) from internal security assessments and Blue List evaluations.</li><li>
Maintain security documentation including system security plans (SSPs), POA&amp;Ms, and network/service inventories for auditable compliance records.</li><li>
Coordinate with assessors and program security officers during formal security reviews of drone systems and supporting infrastructure.</li></ul><p><b>
Network &amp; Device Security</b></p><ul><li>
Conduct and review network security assessments of drone fleet infrastructure, including nmap/Nessus scanning, open port auditing, and firewall rule management.</li><li>
Establish secure remote access patterns for embedded devices (ADB, SSH hardening, udev-based controls) and enforce least-privilege access models.</li><li>
Oversee radio frequency and communications security for drone platforms, including secure licensing and MAC-based authentication workflows for radio hardware.</li><li>
Monitor and respond to security events across fleet management infrastructure using Prometheus/Grafana or similar alerting pipelines.</li></ul><p><b>
Security Program Leadership</b></p><ul><li>
Define and maintain the organization&rsquo;s platform security roadmap, policies, and standards across hardware, firmware, software, and cloud layers.</li><li>
Champion a security-first engineering culture through training, threat modeling workshops, and design reviews.</li><li>
Manage third-party security vendors, penetration testers, and compliance consultants.</li><li>
Track and report on security KPIs and vulnerability SLA compliance to engineering leadership.</li></ul><p></p><h2 class="jobSectionHeader"><b>
Required Qualifications</b></h2><p></p><ul><li>
Bachelor's or master's degree in computer science, Computer Engineering, or a related field.</li><li>
5+ years hands-on experience in application security engineering, product security, or a closely related security engineering role.</li><li>
Deep experience with embedded Linux systems (Yocto/BitBake, systemd, OverlayFS, device bring-up).</li><li>
Strong proficiency in Linux OS hardening: service minimization, Ubuntu security patching (ESM), CVE management, and secure boot.</li><li>
Experience securing CI/CD pipelines (Jenkins, GitLab CI) including artifact signing, secret scanning, and build isolation.</li><li>
Proficiency with container technologies, primarily Docker.</li><li>
Solid understanding of cryptography fundamentals: RSA, TLS, symmetric encryption, PKI, key management best practices.</li><li>
Familiarity with government cloud security frameworks: FedRAMP, NIST 800-171, CMMC Level 2/3, or DoD IL2/IL4.</li><li>
Experience with vulnerability management tooling: Nessus, OpenVAS, nmap, or equivalent.</li><li>
Strong proficiency in scripting (Bash, Python) for security automation and tooling.</li><li>
Strong written communication skills for producing compliance documentation and security assessments.</li><li>
Proficiency with secrets management platforms (HashiCorp Vault, AWS Secrets Manager, SOPS).</li></ul><p></p><h2 class="jobSectionHeader"><b>
Additional Desired Qualifications</b></h2><p></p><ul><li>
Active DoD security clearance or eligibility preferred.</li><li>
Background in drone, robotics, or aviation ssystems security.edge of radio communications security and RF licensing compliance.</li><li>
Relevant certifications: CISSP, OSCP, CSSLP, GREM, or equivalent.</li><li>
Experience with Qualcomm SoC platforms (QRB5165 or similar) and Android Debug Bridge (ADB) workflows.</li></ul><p></p><h2 class="jobSectionHeader"><b>
Physical Requirements and Working Conditions</b></h2><p></p><ul><li>
Must be able to walk, stand, and navigate large indoor and outdoor facilities for extended periods of time.</li><li>
Ability to lift, carry, and move materials and equipment weighing up to 25 lbs on a regular basis.</li><li>
Use of personal protective equipment (PPE) may be required in designated areas or when performing specific tasks, in accordance with safety protocols and company policy.</li><li>
May be required to climb ladders, stoop, kneel, or crouch during inspections, maintenance walk-throughs, or emergency response situations.</li><li>
Regular exposure to facility operations including noise, dust, temperature fluctuations, and industrial equipment.</li><li>
Occasional off-hours or weekend work required for emergency facility responses or projects as needed</li><li>
Requires frequent use of a computer and other standard office equipment for documentation, communication, and coordination tasks.</li></ul><p></p><p><b>
Background</b> <b>Check</b></p><p>
This position will require successfully completing a post-offer background check. Qualified candidates with a criminal history will be considered and are not automatically disqualified, consistent with federal and state law.</p><p><b>
EEO and ITAR/EAR Work Authorization Disclosure</b></p><p>
Red Cat Holdings provides equal employment opportunities (EEO) to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. This position requires direct or indirect access to hardware, software, technology or technical data controlled under the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR). Successful candidates for positions subject to ITAR/EAR restrictions must provide proof of U.S. Citizenship or Permanent Residence and must not require sponsorship for export-restricted work authorization.</p><p><b>
E-Verify</b></p><p>
The company participates E-Verify ensure eligibility for employment and compliance with Right to Work rules.</p><p>
Compensation: Salary plus generous annual equity package and potential bonuses.</p></div>

Platform Security Engineer

<div>Overview:
<div>
LMI, a trusted government contractor with decades of experience delivering cutting-edge solutions, is seeking a driven and innovative <b>Platform Engineer</b> to support the deployment and maintenance of IronSled, a DevSecOps product tailored for government-authorized environments. IronSled accelerates software development and deployment in highly regulated environments by meeting stringent federal security requirements. The product streamlines accreditation processes for secure infrastructure within authorized government networks on cloud or on-premise systems. <b>This position requires and active Secret clearance. This position can be performed remotely or hybrid (with occasional on-site work in government-authorized environments).</b></div><div></div><div><br>
LMI is a new breed of digital solutions provider dedicated to accelerating government impact with innovation and speed. Investing in technology and prototypes ahead of need, LMI brings commercial-grade platforms and mission-ready AI to federal agencies at commercial speed.</div><div></div><div><br>
Leveraging our mission-ready technology and solutions, proven expertise in federal deployment, and strategic relationships, we enhance outcomes for the government, efficiently and effectively. With a focus on agility and collaboration, LMI serves the defense, space, healthcare, and energy sectors&mdash;helping agencies navigate complexity and outpace change. Headquartered in Tysons, Virginia, LMI is committed to delivering impactful results that strengthen missions and drive lasting value.</div>
Responsibilities:<div></div><div><br>
As part of our mission to help clients bridge technology, security, and agility, the Platform Engineer will play a pivotal role in developing, enhancing, and operationalizing the IronSled platform to enable secure software delivery at scale.</div><ul><li><b>
Infrastructure Provisioning:</b> Design, deploy, and maintain cloud and on-premise infrastructure solutions that are compliant with federal security standards (e.g., FedRAMP High, NIST 800-53).</li><li><b>
Platform Development:</b> Build and optimize IronSled&rsquo;s platform features, ensuring continuous improvement of usability, reliability, and security capabilities.</li><li><b>
DevSecOps Pipeline Implementation:</b> Develop, integrate, and maintain CI/CD pipelines with security automation processes embedded directly into software delivery workflows.</li><li><b>
System Administration &amp; Orchestration:</b> Operate and troubleshoot platform services, ensuring high availability and performance.</li><li><b>
Compliance Readiness:</b> Collaborate with cybersecurity teams to design infrastructure and application configurations aligned with evolving government security requirements and accreditation goals.</li><li><b>
Monitoring and Reliability:</b> Implement observability tools and dashboards to monitor platform health, usage trends, and security compliance in real-time.</li><li><b>
Collaboration:</b> Partner closely with developers, security specialists, and client stakeholders to deliver secure and scalable solutions for government-authorized environments.</li><li><b>
Documentation:</b> Create comprehensive documentation for technical processes, infrastructure configurations, and operational procedures to ease audits and accreditation reviews.</li></ul>
Qualifications:
<ul><li><b>Experience:</b></li></ul><ul><li>
5+ years of experience working as a platform engineer, DevSecOps engineer, systems administrator, or similar role.</li><li>
Demonstrated experience managing both cloud (e.g., AWS GovCloud, Azure Government) and on-premise environments.</li><li><b>
This position requires and active Secret clearance.
</b></li><li><b>Technical Skills:</b></li></ul><ul><li>
Expert-level proficiency in cloud platforms like AWS, Azure, GCP, or other government-authorized cloud providers.</li><li>
Strong knowledge of container orchestration tools and platforms (e.g., Kubernetes, OpenShift).</li><li>
Hands-on experience with Infrastructure as Code (IaC) tools (e.g., Terraform, Ansible, or CloudFormation).</li><li>
Familiarity with secure CI/CD pipelines (e.g., GitLab, Jenkins, CircleCI) and security automation tools (e.g., SonarQube, Aqua Security, or Twistlock).</li><li>
Knowledge of network security, identity management (e.g., IAM, RBAC), and secure communications protocols (e.g., TLS/SSL).</li><li><b>
Compliance Expertise:</b></li></ul><ul><li>
Understanding of FedRAMP High, NIST 800-53 frameworks, and other stringent government security requirements.</li><li>
Experience with accreditation and audits for classified or regulated environments.</li><li><b>
Soft Skills:</b></li></ul><ul><li>
Strong collaboration skills&mdash;ability to work with cross-functional teams including developers, security professionals, and government stakeholders.</li><li>
Effective communication and documentation skills to convey technical processes clearly to non-technical audiences.</li></ul></div>

Platform Engineer - Clearance Required

Search 10000+ Product security engineer jobs near you this March. New roles added regularly across leading industries. Apply today.

10000 product security engineer jobs Near Me

Staff Product Security Engineer, Cloud Security

Associate Security Engineer – Application & Product Security

Asset & Wealth Management - Doha - Vice President - Security Engineering

Asset & Wealth Management - Doha - Vice President - Security Engineering

Security Engineer

Platform Security Engineer

Platform Engineer - Clearance Required