BeyondTrust is a place where you can bring your purpose to life through the work that you do, creating a safer world through our cybersecurity SaaS portfolio. Our culture of flexibility, trust, and continual learning means you will be recognized for your growth, and for the impact you make on our success. You will be surrounded by people who challenge, support, and inspire you to be the best version of yourself. The Role The Senior Product Security Engineer will play a pivotal role in ensuring the security of our products through hands-on testing, validation, and in-depth expertise in web application and API security. You will be responsible for identifying, validating, and helping remediate vulnerabilities across our application portfolio, with a strong focus on secure design and effective risk reduction. This role requires direct technical engagement with engineering teams as well as customer-facing discussions when needed. The ideal candidate brings deep experience in application and API security testing, threat modeling, and vulnerability validation, complemented by working knowledge of DevSecOps practices. Open to remote, must be North America based. What You’ll Do <ul> <li>Perform hands-on security testing and validation of web applications, APIs, and cloud-native services.</li> <li>Conduct in-depth penetration testing, code reviews, and manual validation to supplement automated tooling.</li> <li>Lead threat modeling exercises and provide actionable guidance to engineering teams on risk mitigation.</li> <li>Identify and triage vulnerabilities, validate fixes, and ensure remediation is effective.</li> <li>Manage and coordinate third-party penetration tests, ensuring findings are tracked to closure.</li> <li>Provide expertise on web and API security standards (e.g., OWASP Top 10, API Security Top 10).</li> <li>Partner with developers and architects to drive secure coding practices and security-by-design principles.</li> <li>Leverage security testing tools (SAST, DAST, SCA, IAST) while prioritizing manual validation of high-risk areas.</li> <li>Collaborate with DevOps/Platform teams to ensure security controls are embedded in CI/CD pipelines without creating friction.</li> <li>Support internal security awareness and champion security best practices across product teams.</li> </ul> What You’ll Bring <ul> <li>5+ years of progressive experience in Application &amp; Product Security with direct hands-on testing/validation.</li> <li>Strong expertise in web application and API security: authentication/authorization, session management, input validation, cryptography, and common attack vectors.</li> <li>Proficiency with penetration testing methodologies and tools (Burp Suite, Postman, custom scripts, etc.).</li> <li>Strong knowledge of secure coding practices and common vulnerabilities (OWASP Top Ten, API Security Top Ten, CWE).</li> <li>Experience with application security testing tools (SAST, DAST, SCA) combined with manual exploit validation.</li> <li>Understanding of cloud security best practices (preferably AWS).</li> <li>Strong analytical and problem-solving skills; ability to assess risk and drive practical remediation.</li> <li>Excellent communication skills with both technical and non-technical stakeholders.</li> <li>Ability to thrive in an ambiguous, fast-paced environment and take ownership of deliverables.</li> </ul> Nice To Have <ul> <li>Experience with mobile application security testing.</li> <li>Familiarity with container security and infrastructure-as-code scanning.</li> <li>Professional certifications (OSWE, OSCP, GWAPT, CISSP, CSSLP, or equivalent).</li> <li>Experience working with bug bounty programs or vulnerability disclosure programs.</li> </ul> Better Together Diversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected. We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together. About Us BeyondTrust is the global identity security leader protecting Paths to Privilege™. Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders. BeyondTrust is leading the charge in transforming identity security to prevent breaches and limit the blast radius of attacks, while creating a superior customer experience and operational efficiencies. We are trusted by 20,000 customers, including 75 of the Fortune 100, and our global ecosystem of partners. Learn more at <a href="http://www.beyondtrust.com/">www.beyondtrust.com</a>.  #LI-BS1