{"id":3451121,"url":"https://alion.io/job/filigran-staff-appsec-product-security-engineer","title":"Staff AppSec / Product Security Engineer","company":{"id":8105,"name":"Filigran","domain":"filigran.io","url":"https://alion.io/company/filigran","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["FR"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":64000,"max_usd":153000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":724},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"FedRAMP","optional":false},{"name":"GraphQL","optional":false},{"name":"ISO 27001","optional":false},{"name":"Java","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Node JS","optional":false},{"name":"OpenCTI","optional":false},{"name":"Platform Engineering","optional":false},{"name":"Python","optional":false},{"name":"Rust","optional":false},{"name":"Snyk","optional":false},{"name":"SOC 2","optional":false},{"name":"STIX","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"JavaScript","optional":true}],"status":"live","first_seen_at":"2026-10-29T08:44:10Z","employer_posted_date":"2026-10-29","last_verified_at":"2026-11-01T00:21:29Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"The Company\nFounded in 2022, Filigran is a global cybersecurity company on a mission to empower defense teams to be proactive through open-source solutions that uncover threats and drive action.\nFiligran stands out in the cybersecurity ecosystem through its open-source, AI-powered and threat-informed approach to Continuous Threat Exposure Management (CTEM). Our eXtended Threat Management (XTM) platform brings together threat intelligence, exposure validation and cyber risk reduction, enabling organizations to better understand their threat landscape and take action.\nAt the heart of Filigran is our open-source approach. Our vision is to unite defenders into a global community to make security more open, resilient and collaborative.\nAs Filigran continues to scale globally, we are building the organization, infrastructure and capabilities needed for our next stage of growth. How we scale matters just as much as how fast we scale: our CORE values: Cohesion, Openness, Responsibility and Equity shape how we work together, make decisions and build for the future.\nThe Role\nWe're looking for a Staff AppSec / Product Security Engineer to join our Digital Security team, and make security a built-in quality of everything we ship across the XTM platform (OpenCTI, OpenAEV, XTM One, XTM Hub). You'll work closely with the R&D team: the VP, Staff and Principal Engineers, Engineering Managers, Product Owners and the Product Manager. You'll help keep our open source and enterprise products trustworthy for the 6,000+ organizations that defend themselves with them.\nThis is not a solo audit role. As a Staff engineer, you advise the CISO on product security and turn their strategy into day-to-day practice in the product teams. You lead security as a cross-cutting concern, and coach engineers so they own security in their own scope. And of course, you still code: critical security fixes, PR reviews, pair programming and the shared security components that make the secure path the easy one.\nYour Responsibilities\nLeverage AI tools and methodologies to boost productivity and impact\n\nContribute to building AI capabilities into internal workflows\n\nAdvise the CISO on product security strategy across the XTM platform, and lead its operational implementation in the product teams: turn priorities into concrete actions, and track security technical pains to resolution.\n\nLead threat modeling and security reviews in feature refinements with Product Owners: authentication and RBAC, multi-tenancy, connectors, the GraphQL API, and AI and agent features.\n\nEnsure the security quality of the stack through critical PRs, fixes and code reviews, and build shared, secure-by-default components (authorization, secrets, safe outbound calls, input handling).\n\nDrive secure SDLC and supply chain tooling in CI (SAST, SCA, secret and container scanning, Renovate, Snyk, SBOMs, signed releases), tuned so teams trust the results.\n\nRun product vulnerability management: intake from the open source community, researchers and bug bounty, coordinated disclosure, CVEs and advisories, remediation SLAs, and the product side of security incidents.\n\nMentor engineers and grow security champions through pairing, workshops and continuous feedback. Document security architecture decisions so they stay consistent across teams.\n\nWho You’ll Work With\nReports to: the CISO, as part of the Digital Security team.\n\nKey collaborators: the R&D team, including Staff and Principal Engineers and Engineering Managers across the product teams, and Product Owners during refinements, Platform Engineering on infrastructure, compliance (SOC 2 Type 2, ISO 27001:2022, FedRamp) and incidents, and Customer Success on customer security questions and pentest findings.\n\nCommunity: the OpenCTI and OpenAEV open source contributors and the security researchers who report vulnerabilities to us.\n\nMentorship: no direct reports. You'll act as the security technical reference and mentor for engineers across all teams, and grow a network of security champions.\n\nProfile We’re Looking For\nStrong interest in AI and its applications in cybersecurity\n\nComfortable working with and leveraging AI-powered tools (LLMs, automation, copilots, etc.) to improve workflows and productivity\n\nMaster degreee in computer science and or cybersecurity with 8+ years of experience in software engineering and application or product security, including at least 3 years as the security technical reference for a SaaS or enterprise product\n\nComfortable working in a remote, async-first environment\n\nStrong engineering and security skills: you write production code fluently in at least two of Python, Node.js, TypeScript, Java or Rust, and you know web and API security in depth (GraphQL, OIDC/SAML, RBAC, multi-tenant isolation, SSRF, injection), CI/CD security tooling, and container and Kubernetes security\n\nA track record of influence without authority: you led a cross-team security initiative, coached engineers, and got standards adopted with pragmatism and clear priorities\n\nAutonomy, ownership, and team spirit\n\nBonus: AI and LLM security (prompt injection, agent permissions), open source contributions or published CVEs, bug bounty program experience, knowledge of STIX 2.1 / MITRE ATT&CK or hands-on use of OpenCTI or OpenAEV\n\nWhy Join Filigran? More than just a job.\nWe are a fast-growing, global and remote-first company, and we believe the best work combines purpose, impact and innovation. You’ll work alongside talented people across the world who care about what they build, how they build it, and the impact they make on the broader cybersecurity ecosystem.\n⭐ Be part of something bigger\nWe believe we do work that matters. Our open-source approach means that work extends beyond Filigran. You’re contributing to technology and ideas that strengthen a global community of defenders and help make cybersecurity more open and collaborative.\nWork at the edge of what’s next\nWe bring together cybersecurity, open source and AI - giving you the opportunity to work with emerging technologies, experiment with new ways of working, and contribute to how they are applied in practice.\nGlobal opportunity without borders\nBe part of a fast-growing, truly international team - collaborating across Europe, North America, APJ and beyond, with the flexibility of a remote-first environment. As we grow, you’ll have opportunities to expand your scope, take ownership, learn quickly and grow with us.\nA culture grounded in CORE\nCohesion, Openness, Responsibility and Equity define how we work together - with openness, ownership, collaboration and respect. These are the principles that guide how we make decisions, treat people and grow together, especially when no one’s watching.\nWhat you can expect\nCompetitive compensation + equity - everyone shares in our success\n\nRemote-first flexibility - work from wherever you’re based, with flexibility built into how we operate\n\n25 days PTO baseline - real time to disconnect, recharge and enjoy life outside work\n\nVolunteer days - paid time to contribute to causes that matter to you\n\nSet up for success - choose the equipment that works for you, with additional support for your remote work and development needs as our programs evolve\n\nTwo annual in-person get-togethers - one global company get-together and one team get-together, creating dedicated time to connect, collaborate and strengthen our culture beyond the screen\n\nEqual Employment Opportunity\nWe enable cybersecurity through inclusion - from code to culture.\nAt Filigran, we are proud to be an equal opportunity employer. We believe the diversity of our people makes our products and our team stronger. We welcome talent of every background, identity and lived experience, regardless of race, color, religion, gender, gender identity or expression, sexual orientation, national origin, age, disability or veteran status.\nWhat matters here is what you bring, not what you look like, where you’re from or how you identify.\nReady to Join Us?\nApply now and help us build the future of the cybersecurity ecosystem, together.","description_format":"text","description_chars":8085,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"France","iso":"FR","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Information Security","Security Operations","Vulnerability Management"],"lifecycle":[{"event":"open","at":"2026-10-29T11:06:31Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":44,"reasons":["conf:3","velocity","win:early"],"computed_at":"2026-10-31T05:58:55Z"},"pay":null,"html_url":"https://alion.io/job/filigran-staff-appsec-product-security-engineer","json_url":"https://alion.io/job/filigran-staff-appsec-product-security-engineer.json","meta":{"generated_at":"2026-11-01T03:31:55Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5482,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":8105},"rest":"https://alion.io/mcp/rest/get_company?id=8105"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffiligran-staff-appsec-product-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffiligran-staff-appsec-product-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffiligran-staff-appsec-product-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/filigran-staff-appsec-product-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffiligran-staff-appsec-product-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3451121}},{"tool":"search_jobs","arguments":{"company":"filigran.io","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3451121},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}