Product Security Engineer

About the role

Action1 is seeking a Product Security Engineer to protect its multi‑tenant SaaS platform. This remote position works closely with engineering, product, and security teams to embed security throughout the development lifecycle.

Key responsibilities

• Support the Product Security Incident Response Team (PSIRT) and manage vulnerability‑handling activities.
• Validate, triage, track, and coordinate security reports and provide remediation guidance to engineering.
• Review code, APIs, and system architecture, conduct threat modeling, and perform security design reviews.
• Improve security automation in engineering workflows, including SAST, SCA, secrets scanning, and SBOM maintenance.
• Maintain vulnerability‑handling playbooks, product security procedures, and incident‑response runbooks.

Required profile

• 3+ years of experience in product security, application security, DevSecOps, or a related cybersecurity field.
• Strong software engineering background with the ability to collaborate effectively with developers.
• Understanding of application, API, infrastructure, and software supply‑chain security risks.
• Experience with cloud security concepts, identity and access management, and secure cloud architecture patterns.
• Excellent communication skills for interacting with external security researchers and vendors.

Required skills

• SAST and SCA tools
• Secrets scanning
• Software Bill of Materials (SBOM) generation
• AWS security controls and best practices
• C++ or JavaScript programming
• CI/CD pipeline integration for security automation
• Threat modeling techniques

What we offer

• Fully remote work environment
• High ownership with direct impact on product security practices
• Collaboration with engineering, product, and security teams
• Fast‑growing software company with low bureaucracy
• Opportunities to improve security processes, automation, and engineering workflows