Product Security Engineer

Description

Silverfort is on a mission to bring identity security everywhere - to every human, machine, and AI agent, both on-premises and in the cloud.

Our unique technology secures identities and access at runtime, in ways that weren’t possible before. With the broadest identity security platform in the market, trusted by more than 1,000 customers, including many Fortune 100 companies, Silverfort is uniquely positioned to lead the fast-growing identity security category.

Joining Silverfort means becoming part of a fast-moving team with a culture of innovation and collaboration that goes above and beyond to help our customers and each other on a journey to reshape the future of identity security.

We are looking for a Senior Product Security Engineer to join us and own product security across Silverfort’s engineering organization. In this role, you will embed security into the software development lifecycle, partner closely with R&D as an enabler, and build the programs, tooling, and culture that make security a first-class part of how we build.

Responsibilities

• Lead threat modeling across products, features, and architecture changes, and turn findings into actionable security requirements
• Own product security tooling end-to-end - SAST, DAST, SCA, and secrets scanning - from selection and integration to tuning, triage, and remediation
• Run hands-on security code and design reviews, finding real vulnerabilities before they ship
• Partner with R&D to secure new AI/ML features, covering prompt injection, data exposure, and model misuse
• Build security guardrails and secure coding guidelines that make the secure path the easy path for R&D teams
• Own vulnerability intake and CVE handling - responsible disclosure, triage, remediation, and CVE issuance - and coordinate external penetration tests through to closure
• Launch and run the bug bounty program: platform selection, scope, rewards, and researcher relationships
• Drive supply chain and CI/CD security: pipeline hardening, secrets management, SBOM generation, and dependency risk

Requirements

• 5+ years of hands-on experience in application or product security at a software company or security vendor
• Deep knowledge of OWASP Top 10 and web, API, and cloud vulnerability classes, plus cryptography fundamentals (key management, TLS, hashing), with the ability to validate vulnerabilities in real code
• Hands-on experience with SAST (Semgrep, Checkmarx, or similar), DAST (Burp Suite, OWASP ZAP), and SCA (Snyk, Dependabot, or Black Duck)
• Practical threat modeling experience, with a track record of making it useful for engineering teams
• Strong understanding of OAuth 2.0, OIDC, SAML, and JWT, and the security implications of each
• Cloud-native security across AWS or Azure - workloads, containers, serverless, and IaC (Terraform) - and CI/CD pipeline security, including security gates and secrets management (Vault, AWS Secrets Manager, or similar)
• Python or Bash scripting for building security tooling and automating findings workflows
• Hands-on use of AI coding and reasoning tools (Claude, ChatGPT, Copilot, Cursor, and similar) in real production work - using them to ship faster and to higher quality, not just to experiment
• Clear communication and the ability to drive remediation across engineering teams

Advantages:

• CVE research, bug bounty hunting, or a track record of responsible disclosure
• Offensive security background - OSCP, CTF experience, or penetration testing certifications
• Depth in identity protocols: token flows, delegated trust patterns, and identity-related attack vectors
• Experience securing AI/ML features or pipelines