Principal Product Security Engineer

Candescent is a forward-thinking technology company transforming how financial institutions deliver Intelligent Banking experiences. We unite digital banking, account opening, and branch solutions that power and connect digital banking, account opening, and branch solutions-creating seamless engagement across digital, remote, and in-person channels.

Our Experience-Led, Intelligence-Driven approach combines human-centered design with data, automation, and cloud-based innovation. Built on an API-first architecture, our extensible ecosystem enables institutions to adapt quickly, integrate easily, and unlock new opportunities for growth-turning every customer interaction into a moment of clarity, confidence, and connection.

Role Summary

We are seeking a Principal Product Security Engineer to drive the security posture of Candescent’s applications and services throughout the entire Software Development Lifecycle (SDLC). This is a hands-on practitioner role designed for a senior security professional with a strong foundation in software development or engineering.

In this role, you will champion a "shift-left" security culture, embedding core application security practices-including SAST, DAST, SCA, and secure coding standards-directly into modern CI/CD pipelines. Additionally, you will serve as the primary expert responsible for defining secure design patterns and governance for integrating third-party artificial intelligence and large language model (LLM) services across the enterprise.

Key Responsibilities and Deliverables

Core Product Security & Shift-Left Engineering

• Shift-Left Implementation: Partner closely with engineering teams to embed threat modeling, security architecture reviews, and automation early in the product development lifecycle.
• Pipeline Automation (SAST/DAST/SCA): Own the selection, integration, and tuning of Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) tools within automation pipelines.
• Vulnerability Management: Analyze tool outputs, filter out false positives, and collaborate directly with developers to provide actionable, prioritized remediation guidance.
• Secure Coding & Awareness: Define, maintain, and evangelize secure coding best practices based on OWASP Top 10 and real-world threat vectors; conduct technical code reviews and security mentorship for engineering teams.

Secure AI Integration & Governance (Specialized Skill Set)

• Secure AI Architecture: Ability to define and maintain secure integration patterns for third-party AI and LLM services, focusing on API security, authentication, secrets management, and data-in-transit protections.
• Data Guardrails: Ability to establish and enforce input/output controls, prompt handling standards, and data classification guardrails for AI-enabled applications.
• Threat Mitigation: Ability to identify and mitigate AI-specific risks including prompt injection, model manipulation, data leakage, adversarial inputs, and shadow AI adoption.
• Regulatory Compliance: Align internal AI security controls to emerging frameworks (NIST AI RMF, ISO/IEC 42001) and ensure usage satisfies financial regulations (GLBA, PCI DSS, DORA, and NYDFS 23 NYCRR 500).

Requirements

Experience & Technical Background

• Software Engineering Foundation: Strong background as a past software developer and/or security practitioner with a verifiable track record in software engineering.
• AppSec Core: 5-7+ years of experience in security engineering, application security, or product security.
• Hands-on AppSec Tooling: Proven experience configuring, managing, and automating SAST, DAST, and SCA tooling inside automated enterprise deployment workflows.
• Cloud & API Expert: Deep expertise in securing cloud-native environments (AWS, Azure, or GCP) and microservices/API-based integrations.
• AI/ML Security Exposure: Working knowledge of AI/ML enterprise consumer risks (e.g., OWASP LLM Top 10, MITRE ATLAS) and experience securing integrations with major LLM providers.

Security Foundations (Any of the following)

• CISSP - Certified Information Systems Security Professional
• CCSP - Certified Cloud Security Professional
• Cloud Platform Security Certification - AWS Certified Security - Specialty, AZ-500, or Google Professional Cloud Security Engineer

Preferred Qualifications

• Advanced AI Credentials: CAISP (Certified AI Security Professional), CAISS, or AIGP (Artificial Intelligence Governance Professional).

Regulated Environment Experience: Background working within regulated financial services or a tightly controlled compliance environment

Statement to Third Party Agencies

To ALL recruitment agencies: Candescent only accepts resumes from agencies on the preferred supplier list. Please do not forward resumes to our applicant tracking system, Candescent employees, or any Candescent facility. Candescent is not responsible for any fees or charges associated with unsolicited resumes.