Product Security Engineer

About the role

If you like owning problems end to end, making security a default property of everything we build, and working closely with engineering, we want to meet you. Bugcrowd is looking for security engineers who move beyond standard tooling and drive measurable security outcomes our customers can rely on. You will help us shape a culture where security helps others succeed, not just points out problems.

Key responsibilities

• Partner closely with engineering: refine architecture, validate new features, and drive security investment while prioritizing engineering velocity.
• Build security paved roads: contribute to secure defaults, libraries, and "paved roads" that eradicate entire classes of vulnerabilities.
• Create feedback loops: tune security tooling such as SAST, DAST, SCA, and secret scanning to reduce noise and focus on what matters.
• Be our best customer: ensure our bug bounty program serves as a model, experiment with crowd creativity, and provide feedback on platform features.
• Own projects end to end: lead cross‑functional product security projects from scoping through delivery, influencing roadmaps and communicating risk to technical and non‑technical stakeholders.
• Amplify our impact: use code and automation to scale coverage, eliminate repetitive work, and build systems based on incentives and accountability.

Required profile

• 3+ years of experience in product security, application security, or secure software development.
• Ability to review code, automate tasks, and build security tooling in at least one modern programming language (e.g., Python, Go, Ruby, Java).
• Hands‑on experience with threat modeling, secure code review, and automated testing (SAST, DAST, SCA) and a solid grasp of common vulnerability classes (e.g., OWASP Top 10).
• Demonstrated ability to manage projects and influence cross‑functional partners across engineering, DevOps, and product.
• Bachelor's degree in engineering, computer science or a related field, or equivalent practical experience.

Required skills

• Python
• Go
• Ruby
• Java
• SAST
• DAST
• SCA
• Secret scanning
• Threat modeling
• Secure code review
• Automated testing
• OWASP Top 10
• Terraform
• AWS
• GCP
• Kubernetes
• Docker