Principal, Product Security

Duties & Responsibilities

• Lead the architecture and engineering of security controls that protect source code repositories, development environments, build systems, software supply chains, and release processes.
• Design and implement secure CI/CD pipeline patterns, artifact management controls, signing services, and deployment workflows that ensure software integrity from code commit through product release.
• Partner with security-by-design and application security testing teams to operationalize security requirements, vulnerability management, threat modeling outcomes, and release controls.
• Establish and promote secure application and API security standards, including authentication, authorization, secure coding practices, data protection, logging, and abuse prevention.
• Collaborate with engineering teams to reduce application, API, and cloud attack surfaces through secure architecture, identity management, and least-privilege access models.
• Drive modernization of development and engineering environments to mitigate risks associated with credential compromise, malicious code, dependency attacks, and unauthorized releases.
• Integrate security capabilities across source control, CI/CD platforms, cloud services, artifact repositories, governance tools, and security monitoring solutions.
• Automate security controls and operational processes using APIs, infrastructure-as-code, and scripting technologies such as Python, PowerShell, Terraform, GitHub Actions, Azure DevOps, Jenkins, and GitLab.
• Establish security logging, monitoring, and detection requirements for software development and release environments in partnership with security operations teams.
• Develop secure architecture guardrails, reference standards, operational procedures, and technical documentation that support scalable and innovative product delivery.
• Ensure auditable evidence exists for software supply chain controls, artifact integrity, release approvals, SBOM generation, and regulatory or customer assurance requirements.
• Mentor engineers and influence cross-functional teams to adopt secure, customer-focused, collaborative, and accountable engineering practices across global product environments.

Required Skills & Experience

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or a related field; or an equivalent combination of education and experience.
• 7+ years of experience in cybersecurity, product security, application security, software engineering, DevSecOps, cloud security, or a related technical discipline.
• 5+ years of hands-on experience securing software development environments, source code platforms, CI/CD pipelines, or software supply chains.
• Expert-level experience designing and operating security controls across cloud, SaaS, enterprise, and product engineering environments.
• Strong knowledge of software supply chain security, source code protection, secrets management, privileged access management, artifact integrity, dependency governance, and secure release practices.
• Deep understanding of application and API security principles, including OWASP Top 10, OWASP API Security Top 10, secure coding practices, and modern authentication and authorization models.
• Experience troubleshooting complex issues involving source control systems, build platforms, deployment pipelines, artifact repositories, and release management processes.
• Experience implementing path-to-production controls including policy enforcement, release gates, exception management, evidence collection, and deployment readiness criteria.
• Demonstrated ability to communicate technical risk and recommendations effectively to engineering leadership and executive stakeholders.
• Proven ability to influence diverse teams and drive adoption of secure, innovative, and agile engineering practices.
• Strong written, verbal, and stakeholder-management skills.

Preferred Skills & Experience

• Professional certifications such as CISSP, CSSLP, CCSP, GIAC GWEB, GWAPT, GCSA, AWS Security Specialty, Microsoft Certified: Cybersecurity Architect Expert, or equivalent security certifications.
• Hands-on experience with GitHub, GitLab, Azure DevOps, Bitbucket, or similar platforms, including branch protection, code review workflows, signed commits, repository permissions, and secret scanning.
• Experience securing CI/CD platforms such as Jenkins, GitHub Actions, Azure DevOps, and GitLab CI, along with artifact repositories, package registries, and deployment automation solutions.
• Knowledge of secure product architecture, deployment security, artifact signing, provenance, SBOM practices, and release integrity controls.
• Familiarity with software supply chain security frameworks and practices including SLSA, NIST SSDF, OWASP SAMM, and OWASP Top 10.
• Experience applying application and API security principles across web, cloud, mobile, embedded, and service-based architectures.
• Experience using Terraform, AWS CloudFormation, Open Policy Agent, Python, PowerShell, and policy-as-code approaches to automate security controls.
• Understanding of modern product security threats including dependency confusion, malicious packages, source code tampering, credential theft, build pipeline compromise, and release artifact manipulation.
• Experience supporting regulated environments aligned with ISO 27001, SOC 2, NIST, CMMC, IEC 62443, or comparable frameworks.