Principal Product Security Engineer

Cribl

. Set long-term product and cloud security direction across multiple teams .

Posted 11/6/2026full-timeRemote • California • United StatesLead💰 $265,000 - $320,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in cloud security, application security, and product security, with a strong focus on implementing security controls in FedRAMP environments. Proficient in leading security design reviews, threat modeling, and vulnerability management while effectively communicating complex risks to diverse stakeholders.

Highest-signal resume keywords

Cloud Security ExpertiseApplication Security ExperienceFedRAMP Compliance KnowledgeAWS And Azure Security ProficiencyVulnerability Management Skills

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat ModelingSecure Code ReviewVulnerability AnalysisIncident ResponseAutomation In JavaScriptPython ProgrammingGo ProgrammingInfrastructure As CodeEncryption And Key ManagementContinuous Monitoring

Soft Skills

Exceptional CommunicationMentoring And LeadershipProblem-SolvingCollaboration

Tools & Technologies

CI/CDSASTSCAKubernetesContainersAI-Assisted Security EngineeringLogging And Detection

Certifications & Qualifications

Bachelor's Degree In Computer ScienceBachelor's Degree In Cybersecurity

Industry Keywords

NIST SP 800-53OWASP GuidanceMulti-Tenant SaaSCloud-Native SystemsSecurity Design Reviews

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityDistributed SystemsJavaScriptKubernetesPythonTypeScriptGo

About the role

Key responsibilities & impact

Set long-term product and cloud security direction across multiple teams
Lead Product Security Reviews for distributed, multi-tenant SaaS and customer-managed products
Perform architecture and design reviews, threat modeling, abuse-case analysis, targeted secure code review, and security test planning
Translate risk into engineering requirements, mitigations, tests, and secure defaults; verify intended risk reduction
Serve as a principal cloud security authority across IAM, workload identity, network exposure, KMS, encryption, secrets, logging, detection, containers, Kubernetes, serverless services, infrastructure as code, hardening, and data isolation
Lead the Product Security component of FedRAMP engineering and translate FedRAMP Moderate and NIST SP 800-53 control intent into technical controls and evidence
Partner on authorization-boundary and significant-change decisions, continuous monitoring, vulnerability and change management, POA&M and deviation remediation, incident response, vendor assessments, and assessor interactions
Investigate vulnerabilities and ambiguous signals from bug bounty, scanners, penetration tests, cloud detections, and internal reports
Determine exploitability, exposure, and impact; coordinate remediation; validate fixes and bypasses; and hunt for variants and root causes
Evolve risk-adaptive vulnerability management using exposure, exploitability, CISA Known Exploited Vulnerabilities signals, asset criticality, customer impact, and regulatory timelines
Build and operate security capabilities and developer paved roads across CI/CD, SAST, SCA, secrets, infrastructure as code, containers, cloud posture, and testing
Automate repeatable security work while preserving human judgment for consequential decisions
Scope and oversee external penetration tests, purple-team exercises, and security vendors
Lead multi-team work through uncertainty and high-stakes situations, balancing security, reliability, delivery, customer impact, and compliance
Communicate complex risks, options, uncertainty, and recommendations to engineers, senior leaders, customers, assessors, and external partners
Mentor Product Security engineers, security champions, and engineering partners
Create standards, runbooks, automation, and continuity plans
Evaluate and responsibly apply emerging technologies, including AI-assisted security engineering
Perform stand-by, on-call, or off-hours duties

Requirements

What you’ll need

Typically 10+ years of relevant software security, security engineering, or software engineering experience, or equivalent demonstrated scope and impact
Substantial hands-on Application Security or Product Security and cloud security work
Experience securing AI or agentic systems and applying AI responsibly to security engineering workflows
Principal-level track record of setting technical direction across teams, leading multi-quarter initiatives, resolving ambiguous critical problems, and influencing senior Engineering and Product leaders without direct authority
Deep, hands-on AWS and Azure security experience in production SaaS or cloud-native systems
Experience with identity and authorization, network controls, encryption and key management, secrets, logging and detection, containers or Kubernetes, serverless services, infrastructure as code, and multi-tenant data isolation
Direct experience implementing or operating product and cloud security controls in a FedRAMP-authorized or FedRAMP-bound environment
Understanding of NIST SP 800-53 control intent and experience with technical control implementation and evidence, continuous monitoring, vulnerability and change management, POA&M or deviation remediation, and assessor interactions
Expertise leading security design reviews and threat models for complex applications, APIs, distributed systems, and cloud architectures
Strong knowledge of web and application vulnerabilities, exploit techniques, OWASP guidance, authentication and authorization protocols, cryptography, common network protocols, and secure cloud operating models
Ability to read production code and build maintainable automation in JavaScript or TypeScript, Python, Go, or a comparable language
Hands-on vulnerability-response experience, including exploitability analysis, root-cause and variant analysis, remediation design, fix and bypass validation, stakeholder coordination, and incident support
Exceptional written and verbal communication
A bachelor’s degree in computer science, cybersecurity, or a related field—or equivalent practical experience
Stand-by, on-call, or off-hours availability

Benefits

Comp & perks

Health insurance
Dental insurance
Vision insurance
Short-term disability insurance
Life insurance
Paid holidays
Paid time off
Fertility treatment benefit
401(k)
Equity
Cribl Corporate Bonus Program