Product Security Engineer
Bloomreach2 months ago
Remote, SlovakiaMid Level
Responsibilities
- Support implementation and adoption of Secure Software Development Lifecycle practices across engineering teams.
- Review application designs, system architectures, and infrastructure components to identify security risks and recommend mitigations.
- Participate in STRIDE-based threat modeling for new and existing products.
- Conduct security assessments, web application penetration testing, and validation testing.
- Triage, validate, prioritize, and track vulnerabilities through remediation and retesting.
- Provide security guidance and communicate findings to Engineering, DevOps, Compliance, and other stakeholders.
- Develop ownership of assigned product domains and contribute to improvements in security processes, documentation, tooling, and workflows.
Requirements
- At least 2 years of hands-on experience in cybersecurity, application security, product security, or a related security discipline.
- Practical experience performing or supporting web application security assessments and penetration testing.
- Familiarity with threat modeling methodologies such as STRIDE.
- Understanding of vulnerability validation, risk-based prioritization, remediation tracking, and retesting.
- Exposure to AI and LLM technologies and interest in their security risks and controls.
- Working knowledge of application architectures, APIs, authentication, authorization, and application security considerations.
- Knowledge of OWASP standards and resources, including the OWASP Top 10 and Testing Guide.
- Experience with or familiarity with Burp Suite, OWASP ZAP, Nmap, SAST/SCA tools, and other application security technologies.
- Ability to analyze security findings, prioritize vulnerabilities by technical risk and business context, document results, and communicate with stakeholders.
- Strong English communication skills and the ability to collaborate with cross-functional teams.
Benefits
- Virtual-first work arrangement with Bloomreach hubs across three continents and flexible working hours.
- Five paid days off for volunteering, subject to employment type.
- $1,500 annual professional education budget for books, courses, certifications, and other education products.
- Employee Assistance Program, Calm subscription, sports, yoga, and meditation opportunities.
- Quarterly additional DisConnect day and extended parental leave of up to 26 calendar weeks for primary caregivers.
- Restricted Stock Units or Stock Options, company performance bonus, employee referral bonus of up to $3,000, and work-anniversary rewards.
- Professional development workshops, communication coaching, and company events.
Categories
About Bloomreach
Bloomreach builds an AI-driven personalization platform for e‑commerce, combining customer and product data to power marketing automation, on-site search/merchandising, and headless content. Delivered as SaaS with APIs, its products (Engagement, Discovery, and Content) are used by more than 1,400 global brands, including American Eagle, Sonepar, and Pandora. Founded in 2009 and headquartered in Mountain View, California, the company is privately held.