1 day ago
Netanya, Israel or Tel Aviv-Yafo, IsraelStaff+
Responsibilities
- Build and lead security awareness programs that help engineers identify best practices, anti-patterns, and common mistakes before code ships.
- Define and continuously improve security rules and architectural guardrails across JFrog products.
- Build, adopt, and tune automated security reviews within the pull-request process.
- Define AI-assisted security skills and workflows for design and planning.
- Provide hands-on technical assistance to engineering teams and propose centralized architectural fixes for common attack classes.
- Coordinate with the CISO and AppSec teams on security policies for the R&D organization.
- Act as a central technical leader for initiatives such as FedRAMP certification and post-quantum cryptography readiness.
Requirements
- Experience as an Architect, Principal Engineer, or Staff Engineer with a strong security background.
- Hands-on experience assisting development teams with production systems and security fixes.
- Deep production-level experience with Java or C# and their ecosystems.
- Understanding of cloud-native architectures across AWS, GCP, and Azure, as well as self-hosted and on-premises deployments.
- Strong networking fundamentals and knowledge of OAuth2/OIDC, SAML, and mTLS.
- Practical knowledge of SSRF, XSS, SQL injection, broken access control, and other common attack classes.
- Excellent communication, self-management, teaching, tooling, and cross-team influence skills.
- Familiarity with FedRAMP and Common Criteria certifications is advantageous.
- Exposure to post-quantum cryptography concepts and migration planning is advantageous.
- Experience shaping or reviewing AI-assisted development workflows, including AI coding agents or skills, is advantageous.
- Prior enablement, platform, or developer-experience experience influencing multiple teams is advantageous.
- Familiarity with Go, TypeScript, or Python is advantageous.
Categories
About JFrog
JFrog builds a software supply chain platform used by developers and DevOps teams to store, secure, and distribute software artifacts and releases. Its subscription-based SaaS and self-managed products include Artifactory, Xray, Pipelines, and Distribution, and the company, founded in 2008 and headquartered in Sunnyvale, CA, went public on NASDAQ in 2020, serving large enterprises including many Fortune 100 firms.