Staff Product Security Engineer
Greenlight3 months ago
Base Salary
$165k - $200k/yr
Responsibilities
- Lead security architecture and design reviews and threat-modeling sessions using STRIDE, PASTA, and attack trees.
- Translate threats into risk-rated engineering remediations prioritized by severity.
- Conduct penetration tests and security assessments across the full product stack and produce actionable reports.
- Red-team AI-powered products and development tools for prompt injection, data exfiltration, MCP server exploitation, tool misuse, and guardrail weaknesses.
- Drive PSIRT operations, including vulnerability triage, technical investigations, remediation coordination, severity scoring, coordinated disclosure, zero-day response, and incident management.
- Define and enforce enterprise security policies and guardrails for Claude, Cursor, AI-generated code, secrets scanning, and outbound AI traffic.
- Advise architects, product managers, and engineering teams on security and compliance implications and brief executives on emerging AI threats.
- Collaborate with the AI team on securing ML pipelines and mentor junior security engineers.
- Run secure-coding training and champion security-by-design practices across the engineering organization.
Requirements
- 10+ years of product security experience across application security, cloud security, secure SDLC, deployment, and incident response.
- Expert threat-modeling experience using STRIDE, PASTA, or equivalent across web, mobile, cloud, embedded, and AI systems.
- Hands-on penetration testing experience across applications, APIs, cloud infrastructure, hardware, and firmware, demonstrated through research, CVEs, bug bounties, or red-team engagements.
- PSIRT operations experience covering vulnerability intake, triage, investigation, remediation coordination, CVSS scoring, coordinated disclosure, zero-day findings, and incident response.
- Deep AI security expertise, including OWASP Top 10 for LLM, API, and web and mobile security, plus practical MITRE experience.
- Experience with SAST, DAST, SCA, Claude, Cursor, MCP security, AI-generated-code policies, secrets scanning, and DLP for outbound AI traffic.
- Strong programming skills for code review, security-tool development, and workflow automation.
- Deep knowledge of CI/CD pipelines and relevant web and mobile application tools.
- Knowledge of Node.js, Java/Kotlin, React, Redux, Swift, SwiftUI, AWS, GCP, Kubernetes, Ambassador, Helm, MySQL, DynamoDB, and Redis.
- Ability to influence without authority, mentor without managing, and communicate risks to technical, product, legal, compliance, and executive audiences.
- Preferred: hardware and embedded security experience, including secure boot, firmware integrity, hardware root of trust, and IoT threat modeling.
- Preferred: financial-industry experience and knowledge of PCI DSS or COPPA.
Benefits
- Medical, dental, vision, and HSA match
- Paid life insurance, AD&D, and disability benefits
- Traditional 401(k) with company match
- Unlimited PTO and paid company holidays
- Professional development stipends and mental health resources
- Financial planners and fertility healthcare
- 100% paid parental and caregiving leave, including cleaning service and meals during leave
- Flexible work-from-home and in-office opportunities
- Stocked kitchen, catered lunches, occasional in-office happy hours, and employee resource groups
Tech Stack
Amazon DynamoDBAmbassadorAWSGoogle Cloud PlatformHelmJavaKotlinKubernetesMySQLNode.jsPostmanReactRedisReduxSwiftSwiftUI
Categories
About Greenlight
Greenlight builds a family finance and safety platform centered on a debit card for kids and a mobile app for parents, offering tools for earning, saving, spending, giving, and investing, plus GPS trackers and a Family Hub. It sells consumer subscriptions and partners with banks, employers, and schools to distribute the service. Founded in 2014 and headquartered in Atlanta, its products are used by more than 6.5 million family members.