Product Security Engineer

About the role

Action1 is seeking a Product Security Engineer to protect its multi‑tenant SaaS platform. You will partner with engineering, product, and security teams to embed security early in the development lifecycle while keeping delivery velocity high.

Key responsibilities

• Support the Product Security Incident Response Team (PSIRT) and manage vulnerability‑handling activities.
• Validate, triage, track, and coordinate security reports and provide remediation guidance to engineering.
• Review code, APIs, and system architecture to identify security issues early.
• Conduct threat modeling and security design reviews.
• Improve security automation within engineering workflows, including SAST, SCA, and secrets scanning.
• Maintain software bills of materials (SBOMs), dependency visibility, and follow‑up remediation.
• Support security assessments, penetration testing, and vulnerability assessments.
• Maintain vulnerability‑handling playbooks, product security procedures, and incident‑response runbooks.

Required profile

• 3+ years of experience in product security, application security, DevSecOps, or a related cybersecurity field.
• Strong software engineering background with the ability to work closely with developers.
• Deep understanding of application, API, infrastructure, and software supply‑chain security risks.
• Experience applying cloud security concepts, IAM, network security, logging, monitoring, and secure cloud architecture patterns.
• Familiarity with vulnerability management, incident response, security assessments, and secure software development lifecycle practices.
• Experience with threat modeling and security design reviews.
• Excellent professional communication skills.

Required skills

• SAST (Static Application Security Testing)
• SCA (Software Composition Analysis)
• Secrets scanning
• Software Bill of Materials (SBOM) management
• Vulnerability management
• Incident response
• Threat modeling
• Security design reviews
• Cloud security concepts and practices
• Identity and Access Management (IAM)
• Network security
• Logging and monitoring
• Secure cloud architecture patterns