About this role
Job Requirements
We are looking for a Product Security Engineer with hands-on experience in product/application security, vulnerability assessment, threat modeling, and secure software development practices.
Work Experience
Job Description
Product Security Engineer
Experience: 2–5 Years
Role Summary
Key Responsibilities
- Perform security assessments and vulnerability analysis for software-based products.
- Analyse vulnerabilities for exploitability, attack prerequisites, security impact, and remediation.
- Review security findings from static analysis, vulnerability scanning, penetration testing, and open-source component analysis.
- Perform threat modeling based on product architecture, data flows, interfaces, assets, and trust boundaries.
- Identify security threats, attack scenarios, risks, and appropriate security controls and mitigations.
- Work with development and system engineering teams to triage, remediate, and track security findings to closure.
- Support security activities throughout the Secure Software Development Lifecycle (SSDLC).
- Prepare clear technical security assessments, evidence, and release-security documentation.
Required Skills
- 2–5 years of experience in Product Security, Application Security, or Cybersecurity.
- Good understanding of CVE, CWE, CVSS, vulnerability management, and risk assessment.
- Experience with SAST, SCA, vulnerability scanning, and penetration-testing findings.
- Knowledge of threat modeling methodologies such as STRIDE and Data Flow Diagrams (DFDs).
- Understanding of web/application security, network security, authentication, authorization, cryptography, and secure coding principles.
- Familiarity with tools such as GitHub Advanced Security/CodeQL, Coverity, Fortify, Nessus/Tenable, Burp Suite, or equivalent.
- Ability to understand software architecture, network diagrams, interfaces, and security requirements.
- Good analytical, technical documentation, and communication skills.
Good to Have
- Experience working in medical devices or other regulated product environments.
- Awareness of IEC 81001-5-1, FDA cybersecurity guidance, OWASP, and NIST cybersecurity practices.
- Basic scripting experience with Python, PowerShell, or Bash.