Product Security Engineer (m/f/d)
Aras Corporation2 months ago
Remote, PolandMid Level
Responsibilities
- Design, develop, and maintain secure CI/CD pipelines using Jenkins, Kubernetes, Azure, and cloud-native technologies.
- Integrate security controls and automated security testing, including SAST, DAST, SCA, secrets detection, IaC scanning, container security, and software supply chain security.
- Drive security automation initiatives and develop automation solutions using Python, PowerShell, Bash, or Groovy.
- Document and verify security mitigations, identify additional mitigations, and guide product development teams through remediation.
- Conduct security reviews of applications, infrastructure, CI/CD workflows, and deployment architectures.
- Support threat modeling, risk assessments, secure design reviews, security verification, and validation efforts.
- Establish security baselines, hardening standards, and secure deployment practices.
- Collaborate with product, software development, cloud engineering, DevOps, and security teams to embed security throughout the SDLC.
- Participate in incident response, issue triage, daily collaboration, sprint planning, retrospectives, and design sessions.
- Evaluate tools and approaches that improve security effectiveness and developer experience.
Requirements
- At least 4 years of hands-on experience with Jenkins or similar CI/CD platforms.
- At least 3 years of software development, automation, or scripting experience using Python, PowerShell, Bash, or equivalent languages.
- Experience integrating SAST, DAST, SCA, container scanning, and secrets management into CI/CD pipelines.
- Working knowledge of cloud security principles and services in Azure and/or AWS.
- Understanding of containerized environments and Kubernetes security concepts.
- Experience collaborating with engineering teams in Agile development environments.
- Strong analytical, troubleshooting, and problem-solving skills, with the ability to work independently and manage multiple priorities.
- Bachelor’s degree in computer science, information technology, cybersecurity, or equivalent practical experience.
- Preferred experience includes Terraform, Bicep, CloudFormation, Azure DevOps pipelines, software supply chain security, Kubernetes and cloud-native platforms, and secure AI engineering practices.
- Preferred knowledge includes SBOM, SLSA, Sigstore, provenance validation, NIST SSDF, OWASP SAMM, OWASP ASVS, and CIS Benchmarks.
- Highly desirable certifications include Microsoft Certified: Azure Security Engineer Associate, Microsoft Certified: DevOps Engineer Expert, Certified Kubernetes Security Specialist, or Certified Kubernetes Administrator.
Benefits
- The position is available to candidates located in Poland.
- The role offers collaboration with product, software engineering, cloud architecture, DevOps, and security stakeholders.
- The position emphasizes developer-friendly security automation and secure-by-design engineering practices.
About Aras Corporation
Aras builds Aras Innovator, a low‑code product lifecycle management (PLM) and digital thread platform used by engineering and manufacturing organizations to manage multi‑CAD data, changes, requirements, and quality. It sells enterprise subscriptions, cloud hosting, and services for configuring and integrating PLM across complex IT landscapes. Founded in 2000 and headquartered in Andover, Massachusetts, Aras is privately held and operates subsidiaries such as XPLM that focus on integrations between ECAD, PLM, and related systems.