Product Security Engineer

About the role

Security at CognitiveClouds needs to be part of how products are engineered, not a review that happens at the end.

The Product Security Engineer will work directly with software and platform teams to improve application security, cloud security, secure development practices and the systems we use to detect and respond to risk.

Because CognitiveClouds builds enterprise and regulated software, this role spans code, infrastructure, architecture, automation and engineering process.

What you'll do

• Review product and platform architectures for security risks.
• Perform security-focused code reviews.
• Improve secure coding practices across engineering teams.
• Build automated security checks into CI/CD pipelines.
• Identify and remediate application vulnerabilities.
• Improve cloud and infrastructure security.
• Review authentication, authorization and identity architectures.
• Strengthen secrets, encryption and key-management practices.
• Improve container and infrastructure-as-code security.
• Participate in threat modelling.
• Work with vulnerability-management and penetration-testing processes.
• Improve security monitoring and incident-response capability.
• Help engineering teams meet relevant customer and compliance requirements without turning security into bureaucracy.
• Document repeatable security standards and patterns.

You might be a fit if

• You are a security engineer who can also write software.
• You have strong application-security fundamentals.
• You understand modern cloud environments.
• You are comfortable with TypeScript, Python or comparable production languages.
• You understand APIs, identity, authentication and authorization.
• You have experience with CI/CD and infrastructure-as-code.
• You understand container and cloud security.
• You can reason about threat models rather than simply running scanners.
• You understand frameworks such as ISO 27001, SOC 2, GDPR or equivalent controls.
• You can work collaboratively with engineers and improve security without unnecessarily slowing delivery.