Principal Product Security Engineer

Location: Remote from the United States, Canada, or United Kingdom

Base salary: $229,000–$258,000 USD annually

Company

hirify.global delivers hardened, secure, production-ready builds of open source software for enterprises and AI agents, helping customers build faster, stay compliant, and reduce risk.

What you will do

• Set product security direction across major products and platforms and embed security by design into engineering and product roadmaps.
• Lead multi-quarter, cross-functional programs including secure SDLC improvements and vulnerability reduction.
• Build automation for vulnerability detection, triage, and remediation, including STIGs, CIS baselines, and policy-as-code.
• Improve the use of penetration tests, vulnerability assessments, bug bounty programs, and red-team activity so findings result in lasting engineering changes.
• Guide the integration of static and dynamic analysis, dependency and license checks, and IaC scanners into CI/CD workflows.
• Translate compliance frameworks into practical controls, advise senior leaders on risk trade-offs, mentor engineers, and track emerging threats and supply-chain risks.

Requirements

• 10+ years of experience in software, product, or application security, with ownership of complex products or platforms.
• Deep expertise in secure architecture and system design for cloud-native or distributed systems, including modern authentication, authorization, and defense-in-depth patterns.
• Experience driving organization-level risk management and security programs, including secure SDLC, AI SDLC, and vulnerability management, from design through rollout.
• Strong hands-on familiarity with containers, Kubernetes, public cloud, and related security controls.
• Experience with security compliance frameworks such as SOC 2, ISO 27001, and SLSA, and with translating controls into practical engineering work.
• Ability to automate security workflows in at least one language such as Go, Python, or Shell and integrate them into CI/CD.
• Proven ability to influence senior stakeholders and align teams through clear, concise communication in a remote-first environment.
• High ownership, accountability, and adaptability, including anticipating risks, navigating ambiguity, and improving systems and teams.

Nice to have

• Software supply-chain security experience, including SBOMs, SLSA, provenance, signing, or build-system hardening.
• Red-team or offensive-security experience and/or open-source software development in security-sensitive projects.
• Public speaking or writing on security topics and participation in industry communities or standards.
• Experience in early-stage or high-growth companies where security moves at product speed.

Culture & Benefits

• Remote-first work with team meetups, bi-annual destination summits, and a monthly coworking, phone, and internet stipend.
• Stock options upon hire and promotion, participation in secondary offerings, and a 10-year exercise period.
• 100% covered health, vision, and dental insurance premiums for employees and dependents.
• Flexible time off.
• Paid parental leave of 18 weeks for birthing parents and 12 weeks for non-birthing parents.
• Values include customer focus, intentional action, transparency, trust, and assuming good intentions.