Senior Security Software Engineer/Developer (Product Security)

Location: Remote in the United States or Canada

Company

hirify.global builds intelligent connectivity infrastructure through broadband access, content delivery, cloud-native software, automation, and AI-enabled solutions.

What you will do

• Identify and reduce product security risks from early design through deployment, maintenance, and end of life.
• Lead threat modelling for products, features, and architecture changes, covering assets, trust boundaries, attack surfaces, abuse cases, attack paths, and controls.
• Review security-sensitive architectures and translate findings into engineering requirements, implementation guidance, verification plans, and actionable development work.
• Coach developers and architects on secure design, secure coding, threat modelling, and security testing while providing practical technical leadership.
• Improve secure development through risk-based release criteria, reusable guidance, security reviews, and automated CI/CD checks.
• Support SBOM generation and disclosure, CVE monitoring and triage, vulnerability remediation, PSIRT practices, ISO/IEC 27001 technical controls, and customer security reviews.

Requirements

• 5+ years of professional software engineering, security engineering, or combined experience, including significant hands-on experience securing production software.
• Experience with Linux, source control, code review, build systems, CI/CD, automated testing, and modern software development practices.
• Ability to understand production software at source-code level and collaborate with developers on security-sensitive changes.
• Programming ability in at least one relevant language, such as C, C++, Python, Go, Java, JavaScript/TypeScript, or Rust.
• Experience applying Product Security or Application Security practices within a software development organization.
• Strong understanding of secure software design, common vulnerability classes, attack techniques, defensive controls, and practical threat modelling using STRIDE, attack trees, abuse cases, or an equivalent approach.
• Experience reviewing software or system architectures from a security perspective and converting risks into practical engineering requirements.
• Experience investigating vulnerabilities, including technical impact, exploitability, affected components, and mitigations.
• Experience with SBOM and software composition analysis tools, familiarity with CycloneDX, and working knowledge of dependencies, vulnerability databases, software supply-chain risk, remediation, and production software delivery.
• Ability to explain complex security risks to developers, architects, product leaders, auditors, and customers; lead through technical credibility, collaboration, coaching, and influence.
• Ability to balance risk reduction with product constraints, delivery requirements, reliability, performance, and maintainability while working across multiple engineering teams.

Nice to have

• Embedded Linux or Linux-based product development; experience with networking products, telecommunications, distributed systems, or cloud-connected appliances.
• Experience with secure boot, trusted execution, hardware-backed identity, cryptographic key management, signed software updates, or device lifecycle security.
• Hands-on vulnerability reproduction and investigation, including SAST, DAST, fuzzing, penetration testing, binary analysis, reverse engineering, or runtime security analysis.
• Knowledge of CycloneDX VEX, CSAF, SPDX, purl, CPE, CVE, CVSS, CWE, CISA Known Exploited Vulnerabilities, vulnerability disclosure, or PSIRT processes.
• Experience improving SBOM and vulnerability data quality, ISO/IEC 27001 technical audit evidence, secure development programs, or standards such as NIST SSDF, OWASP SAMM, or IEC 62443.
• Relevant security or software certifications.

Culture & Benefits

• Remote work is available in the United States and Canada.
• Product Security operates as an engineering partner rather than a final-stage approval function.
• Hands-on collaboration is expected with software architects, developers, product management, compliance, and service-provider customers.
• The role focuses on product security rather than security operations, corporate network administration, or general corporate IT security.

Hiring process

• Submit the application with all required fields and documents.
• Shortlisted candidates complete an HR screening, followed by phone or video interviews and, if applicable, a technical test or assignment.
• Final interviews may be in person or panel-based; references, employment or education verification, and a criminal background check may be required.