Staff Product Security Engineer
Guidewire SoftwareResponsibilities
- Plan and perform penetration tests of web applications, APIs, cloud services, integrations, multi-tenant SaaS environments, and AI/ML-powered features.
- Identify, reproduce, validate, risk-rate, and retest vulnerabilities, providing actionable remediation guidance to engineering teams.
- Develop penetration testing scripts, tooling, automation, and evaluate AI-assisted and autonomous testing tools.
- Own penetration testing schedules, scope, rules of engagement, environments, access, release milestones, and vendor engagements.
- Manage third-party penetration testing vendors, statements of work, reports, quality reviews, escalations, budgets, forecasting, and performance evaluation.
- Ensure testing satisfies compliance obligations and customer requirements, maintain audit evidence and attestation materials, and report remediation and program metrics.
- Support PSIRT activities including vulnerability triage, incident coordination, root cause analysis, security releases, and validation of SAST, DAST, SCA, and container scanning findings.
Requirements
- Bachelor’s or master’s degree in computer science, or equivalent experience.
- At least 7 years of application or product security experience, including at least 5 years of hands-on penetration testing of web applications, APIs, and cloud-hosted services.
- Experience managing third-party penetration testing vendors, including scoping, scheduling, and report review.
- Hands-on experience testing AWS-hosted applications, IAM, and multi-tenant architectures.
- Working knowledge of SOC 2, ISO 27001, PCI DSS, OWASP Top 10, OWASP API Security Top 10, OWASP Top 10 for LLM Applications, and common product vulnerability classes.
- Experience with Burp Suite, SAST, DAST, vulnerability scanning tools, and CVSS risk rating.
- Scripting ability in Python, Shell, or similar languages for testing tools and automation.
- Strong written and verbal communication skills, including writing reports for engineers, executives, and customers.
- Ability to build relationships and influence internal teams, vendors, and external partners.
- Preferred qualifications include OSCP, OSWE, GPEN, GWAPT, CSSLP, or CISSP certifications; AI/LLM application testing; bug bounty participation or published security research; security research community knowledge; Java, C++, or Python development; PSIRT experience; and experience with regulated SaaS products.
About Guidewire Software
Guidewire is the platform P&C insurers trust to engage, innovate, and grow efficiently. More than 570 insurers in 43 countries, from new ventures to the largest and most complex in the world, rely on Guidewire products. With core systems leveraging data and analytics, digital, and artificial intelligence, Guidewire defines cloud platform excellence for P&C insurers. We are proud of our unparalleled implementation record, with 1,700+ successful projects supported by the industry’s largest R&D team and SI partner ecosystem. Our marketplace represents the largest partner community in P&C, where customers can access hundreds of applications to accelerate integration, localization, and innovation. For more information, please visit https://www.guidewire.com/.