Staff Product Security Engineer

Summary

In this role, you’ll shape and run a pen testing program that combines hands-on testing, third-party vendor engagements, and AI-assisted tooling. You’ll ensure every product is tested before release, findings are validated and fixed, and our products meet customer, contractual, and regulatory requirements. You’ll partner closely with product, engineering, and compliance teams, setting the direction for how security testing scales with the business as a Staff Security Engineer.

As needed, you’ll also support broader Product Security Incident Response Team (PSIRT) activities, such as vulnerability triage and incident coordination.

Job Description

What you’ll do

Primary responsibilities

Penetration testing

• Plan and perform penetration tests of Guidewire web applications, APIs, cloud services, and integrations to identify critical vulnerabilities before release and in production.
• Test tenant isolation, cross-tenant data access and authorization boundaries in multi-tenant SaaS environments.
• Lead security testing of AI/ML-powered product features, including LLM applications, APIs, and inference endpoints. Identify issues such as prompt injection, data and model leakage, insecure RAG implementations, and abuse vectors.
• Validate, reproduce and risk-rate findings using industry-standard metrics such as CVSS, and give engineering teams clear, actionable remediation guidance.
• Retest fixes and confirm closure before findings are marked resolved.
• Develop pen testing tooling, scripts and automation, and evaluate AI-assisted and autonomous testing tools to scale coverage and repeatability.

Pen testing vendor management

• Own the pen testing schedule across the product release lifecycle, from early access through general availability (including continuously delivered products), ensuring every product is tested prior to key release milestones.
• Decide when and how products need testing based on risk, release scope and compliance requirements.
• Define testing scope, rules of engagement, environments, and access for each vendor engagement.
• Align product teams, implementation partners and vendors on their pen testing responsibilities, including environment readiness and access.
• Manage vendor relationships end-to-end: onboarding, statements of work, kickoff, status tracking, quality reviews of reports, and issue escalation.
• Manage the pen testing budget, including vendor costs, forecasting and utilization.
• Review vendor reports for accuracy and completeness, remove false positives and consolidate findings into the vulnerability management process.
• Evaluate vendor performance and coverage, recommending methodology or vendor changes as needed.

Compliance and reporting

• Ensure pen testing meets compliance obligations for Guidewire products, such as SOC 2, ISO 27001, PCI DSS, and customer contractual requirements.
• Maintain pen test evidence, attestation letters and executive summaries for auditors and customers.
• Track remediation of pen test findings against SLAs and report status and risk to product, engineering, and security leadership.
• Define and report program metrics such as test coverage, on-time completion, finding age, and SLA compliance.
• Respond to customer security questions about pen testing practices and results.

Secondary responsibilities (as needed)

When PSIRT needs extra capacity, you will support the broader incident response program:

• Triage internally and externally reported security issues, verify them across product versions, and perform root cause analysis.
• Coordinate with external security researchers, reporting organizations, and customers on reported vulnerabilities.
• Support security releases with engineering and sustaining teams, including security-focused code and design reviews.
• Validate findings from SAST, DAST, SCA and container scanning tools, and help improve PSIRT and vulnerability management processes.

What you’ll bring

• Bachelor's or master's degree in computer science, or equivalent experience.
• 7+ years of application or product security experience, including at least 5 years of hands-on penetration testing of web applications, APIs, and cloud-hosted services.
• Proven experience managing third-party pen testing vendors, including scoping, scheduling and report review.
• Hands-on experience testing applications hosted on AWS, including IAM and multi-tenant architectures.
• Working knowledge of compliance requirements for pen testing, such as SOC 2, ISO 27001, or PCI DSS.
• Solid understanding of the OWASP Top 10, OWASP API Security Top 10, OWASP Top 10 for LLM Applications, and common product vulnerability classes.
• Hands-on experience with pen testing tools such as Burp Suite, along with SAST, DAST and vulnerability scanning tools.
• Experience risk-rating vulnerabilities with CVSS.
• Scripting skills (Python, Shell, or similar) to build testing tools and automation.
• Strong written and verbal communication skills, including the ability to write clear pen test reports for engineers, executives, and customers.
• Proven ability to build relationships and influence people at all levels, as well as vendors and external partners.

Nice to have

• Industry certifications such as OSCP, OSWE, GPEN, GWAPT, CSSLP, or CISSP.
• Experience testing AI/LLM applications in production.
• Bug bounty participation or published security research.
• Knowledge of the security research community.
• Development experience in Java, C++ or Python.
• Experience in a PSIRT or product incident response role.
• Experience with insurance, financial services, or other regulated SaaS products.

About Guidewire

Guidewire is the platform P&C insurers trust to engage, innovate, and grow efficiently. We combine digital, core, analytics, and AI to deliver our platform as a cloud service. More than 540+ insurers in 40 countries, from new ventures to the largest and most complex in the world, run on Guidewire.

As a partner to our customers, we continually evolve to enable their success. We are proud of our unparalleled implementation track record with 1600+ successful projects, supported by the largest R&D team and partner ecosystem in the industry. Our Marketplace provides hundreds of applications that accelerate integration, localization, and innovation.

For more information, please visit www.guidewire.com and follow us on Twitter: @Guidewire_PandC.

Guidewire Software, Inc. is proud to be an equal opportunity and affirmative action employer. We are committed to an inclusive workplace, and believe that a diversity of perspectives, abilities, and cultures is a key to our success. Qualified applicants will receive consideration without regard to race, color, ancestry, religion, sex, national origin, citizenship, marital status, age, sexual orientation, gender identity, gender expression, veteran status, or disability. All offers are contingent upon passing a criminal history and other background checks where it's applicable to the position.

Guidewire is proud to be a disability inclusive employer. We are committed to providing individualized accommodations and support to candidates for any part of our hiring process. If you think you may need disability-related accommodations, please email EmployAbility at [email protected], our disability partner, or schedule a call with an EmployAbility expert (calendar booking slot) for a confidential conversation.