{"id":4301421,"url":"https://alion.io/job/guidewire-staff-product-security-engineer","title":"Staff Product Security Engineer","company":{"id":6488,"name":"Guidewire","domain":"guidewire.com","url":"https://alion.io/company/guidewire","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":80,"open_postings":15,"ghost_share":0,"stale_share":0.8,"repost_share":0,"time_to_fill_p50_days":26,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Mexico","Brazil"],"countries":["MX","BR"],"hiring_countries":["MX"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Burp Suite","optional":false},{"name":"CVSS","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"LLM","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"SOC 2","optional":false},{"name":"C++","optional":true},{"name":"Java","optional":true}],"status":"live","first_seen_at":"2026-11-13T00:00:00Z","employer_posted_date":"2026-11-13","last_verified_at":"2026-11-14T03:31:25Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Summary\nWe’re looking for a Staff Security Engineer to lead penetration testing across Guidewire’s products.In this role, you’ll shape and run a pen testing program that combines hands-on testing, third-party vendor engagements, and AI-assisted tooling. You’ll ensure every product is tested before release, findings are validated and fixed, and our products meet customer, contractual, and regulatory requirements. You’ll partner closely with product, engineering, and compliance teams, setting the direction for how security testing scales with the business as a Staff Security Engineer.\nAs needed, you’ll also support broader Product Security Incident Response Team (PSIRT) activities, such as vulnerability triage and incident coordination.\nJob Description\nWhat you’ll do\nPrimary responsibilities\nPenetration testing\nPlan and perform penetration tests of Guidewire web applications, APIs, cloud services, and integrations to identify critical vulnerabilities before release and in production.\nTest tenant isolation, cross-tenant data access and authorization boundaries in multi-tenant SaaS environments.\nLead security testing of AI/ML-powered product features, including LLM applications, APIs, and inference endpoints. Identify issues such as prompt injection, data and model leakage, insecure RAG implementations, and abuse vectors.\nValidate, reproduce and risk-rate findings using industry-standard metrics such as CVSS, and give engineering teams clear, actionable remediation guidance.\nRetest fixes and confirm closure before findings are marked resolved.\nDevelop pen testing tooling, scripts and automation, and evaluate AI-assisted and autonomous testing tools to scale coverage and repeatability.\nPen testing vendor management\nOwn the pen testing schedule across the product release lifecycle, from early access through general availability (including continuously delivered products), ensuring every product is tested prior to key release milestones.\nDecide when and how products need testing based on risk, release scope and compliance requirements.\nDefine testing scope, rules of engagement, environments, and access for each vendor engagement.\nAlign product teams, implementation partners and vendors on their pen testing responsibilities, including environment readiness and access.\nManage vendor relationships end-to-end: onboarding, statements of work, kickoff, status tracking, quality reviews of reports, and issue escalation.\nManage the pen testing budget, including vendor costs, forecasting and utilization.\nReview vendor reports for accuracy and completeness, remove false positives and consolidate findings into the vulnerability management process.\nEvaluate vendor performance and coverage, recommending methodology or vendor changes as needed.\nCompliance and reporting\nEnsure pen testing meets compliance obligations for Guidewire products, such as SOC 2, ISO 27001, PCI DSS, and customer contractual requirements.\nMaintain pen test evidence, attestation letters and executive summaries for auditors and customers.\nTrack remediation of pen test findings against SLAs and report status and risk to product, engineering, and security leadership.\nDefine and report program metrics such as test coverage, on-time completion, finding age, and SLA compliance.\nRespond to customer security questions about pen testing practices and results.\nSecondary responsibilities (as needed)\nWhen PSIRT needs extra capacity, you will support the broader incident response program:\nTriage internally and externally reported security issues, verify them across product versions, and perform root cause analysis.\nCoordinate with external security researchers, reporting organizations, and customers on reported vulnerabilities.\nSupport security releases with engineering and sustaining teams, including security-focused code and design reviews.\nValidate findings from SAST, DAST, SCA and container scanning tools, and help improve PSIRT and vulnerability management processes.\nWhat you’ll bring\nBachelor's or master's degree in computer science, or equivalent experience.\n7+ years of application or product security experience, including at least 5 years of hands-on penetration testing of web applications, APIs, and cloud-hosted services.\nProven experience managing third-party pen testing vendors, including scoping, scheduling and report review.\nHands-on experience testing applications hosted on AWS, including IAM and multi-tenant architectures.\nWorking knowledge of compliance requirements for pen testing, such as SOC 2, ISO 27001, or PCI DSS.\nSolid understanding of the OWASP Top 10, OWASP API Security Top 10, OWASP Top 10 for LLM Applications, and common product vulnerability classes.\nHands-on experience with pen testing tools such as Burp Suite, along with SAST, DAST and vulnerability scanning tools.\nExperience risk-rating vulnerabilities with CVSS.\nScripting skills (Python, Shell, or similar) to build testing tools and automation.\nStrong written and verbal communication skills, including the ability to write clear pen test reports for engineers, executives, and customers.\nProven ability to build relationships and influence people at all levels, as well as vendors and external partners.\nNice to have\nIndustry certifications such as OSCP, OSWE, GPEN, GWAPT, CSSLP, or CISSP.\nExperience testing AI/LLM applications in production.\nBug bounty participation or published security research.\nKnowledge of the security research community.\nDevelopment experience in Java, C++ or Python.\nExperience in a PSIRT or product incident response role.\nExperience with insurance, financial services, or other regulated SaaS products.\nAbout Guidewire\nGuidewire is the platform P&C insurers trust to engage, innovate, and grow efficiently. We combine digital, core, analytics, and AI to deliver our platform as a cloud service. More than 540+ insurers in 40 countries, from new ventures to the largest and most complex in the world, run on Guidewire.\nAs a partner to our customers, we continually evolve to enable their success. We are proud of our unparalleled implementation track record with 1600+ successful projects, supported by the largest R&D team and partner ecosystem in the industry. Our Marketplace provides hundreds of applications that accelerate integration, localization, and innovation.\nFor more information, please visit www.guidewire.com and follow us on Twitter: @Guidewire_PandC.\nGuidewire Software, Inc. is proud to be an equal opportunity and affirmative action employer. We are committed to an inclusive workplace, and believe that a diversity of perspectives, abilities, and cultures is a key to our success. Qualified applicants will receive consideration without regard to race, color, ancestry, religion, sex, national origin, citizenship, marital status, age, sexual orientation, gender identity, gender expression, veteran status, or disability. All offers are contingent upon passing a criminal history and other background checks where it's applicable to the position.\nGuidewire is proud to be a disability inclusive employer. We are committed to providing individualized accommodations and support to candidates for any part of our hiring process. If you think you may need disability-related accommodations, please email EmployAbility at , our disability partner, or schedule a call with an EmployAbility expert (calendar booking slot) for a confidential conversation.","description_format":"text","description_chars":7451,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Mexico","iso":"MX","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["InsurTech"],"lifecycle":[{"event":"open","at":"2026-11-14T03:31:25Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":28,"reasons":["conf:2","win:early","comp:brand"],"computed_at":"2026-11-14T05:44:27Z"},"pay":null,"html_url":"https://alion.io/job/guidewire-staff-product-security-engineer","json_url":"https://alion.io/job/guidewire-staff-product-security-engineer.json","meta":{"generated_at":"2026-11-14T05:44:27Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9704,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6488},"rest":"https://alion.io/mcp/rest/get_company?id=6488"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fguidewire-staff-product-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fguidewire-staff-product-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fguidewire-staff-product-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/guidewire-staff-product-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fguidewire-staff-product-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4301421}},{"tool":"search_jobs","arguments":{"company":"guidewire.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4301421},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}