Product Security Engineer

About the role

You will act as the designated security focus for a specific product domain, driving threat modeling, security assessments, and vulnerability management across Bloomreach's platform. You will support the implementation of Secure Software Development Lifecycle (SSDLC) practices and provide security guidance to engineering teams.

Key responsibilities

• Support SSDLC adoption across engineering teams and integrate security throughout product development.
• Perform security reviews of application designs, system architectures, and infrastructure components.
• Participate in threat modeling exercises (e.g., STRIDE) for new and existing products.
• Conduct security assessments, penetration testing, and validation testing using established methodologies.
• Triage, validate, and assign vulnerabilities identified through tools and assessments, ensuring timely remediation.
• Collaborate with engineering, DevOps, compliance, and cross‑functional teams to address security requirements.

Required profile

• 2+ years of hands‑on experience in cybersecurity, application security, or product security.
• Practical experience performing security assessments and penetration testing of web applications.
• Familiarity with threat modeling concepts such as STRIDE.
• Understanding of vulnerability management fundamentals and risk‑based prioritization.
• Exposure to AI and LLM technologies with interest in associated security risks.

Required skills

• Working knowledge of modern application architectures, APIs, authentication and authorization mechanisms.
• Knowledge of OWASP standards, including OWASP Top 10 and Testing Guide.
• Hands‑on experience with security testing tools such as Burp Suite, OWASP ZAP, Nmap, SAST/SCA tools.
• Ability to analyze and validate security findings and prioritize vulnerabilities based on technical risk.