Staff Security Engineer, Product Security

Location: U.S. Remote; other listed location: San Francisco, California, United States.

Salary: USD 148,210–270,703 annually, with ranges varying by U.S. location.

Company

hirify.global builds technology for global commerce and supply-chain operations, helping companies move merchandise across more than 112 countries.

What you will do

• Define security architecture, secure-by-default patterns, and reference implementations for products and services.
• Lead security engineering reviews for high-risk product features and partner with engineering leadership on complex design tradeoffs.
• Lead domain-specific threat modeling and attack-surface analysis across the product surface.
• Set standards for triaging, reproducing, and prioritizing bug bounty submissions and internal security reports, and drive remediation of systemic vulnerabilities.
• Build and scale the security champions program and product security training.
• Own security services and tooling used by product teams, mentor engineers, and serve as the technical voice for product security across engineering leadership.

Requirements

• Typically 8+ years of experience in product or application security, including hands-on work building security tools and services; demonstrated results matter more than the exact number of years.
• Experience designing security architecture that scales across multiple teams and services.
• Strong understanding of web application security principles and hands-on experience with application testing tools such as Burp Suite, OWASP ZAP, or similar.
• Software development experience building security tools in at least one modern language, such as Go, Python, Java/Kotlin, TypeScript, Ruby, or similar.
• Experience leading multi-team technical initiatives and mentoring engineers into senior roles.

Nice to have

• Experience running or scaling a security champions program.
• Identity management and identity federation experience, including SAML, OAuth, or SCIM.
• Experience with IaaS cloud infrastructure, Kubernetes, containers, and service-oriented architectures.
• Hands-on experience with bug bounty platforms and SAST tools such as Cycode, Semgrep, Snyk, or similar.
• Experience performing code audits on internal or open-source libraries before production release.

Culture & Benefits

• Collaborate with teammates across continents using Slack, video, and asynchronous documentation.
• Access modern hardware and software, including frontier AI models from the first day.
• Work in an agile environment where the team determines how it works best.
• Security works closely with platform and infrastructure teams and is treated as an engineering function.
• Total rewards include bonus, equity, medical and dental benefits, and flexible time off.