Product Security Engineer

Silverfort

. Lead threat modeling across products, features, and architecture changes .

Posted 11/4/2026full-timeRemote • IsraelMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in application and product security, with a strong focus on threat modeling, vulnerability management, and security tooling. Proficient in securing AI/ML features and implementing CI/CD security practices.

Highest-signal resume keywords

Threat ModelingApplication SecurityVulnerability ManagementSAST ToolsCI/CD Pipeline Security

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Application SecurityThreat ModelingVulnerability ManagementCryptography FundamentalsOWASP Top 10SAST ToolsDAST ToolsSCA ToolsCloud-Native SecurityPython Scripting

Soft Skills

Clear CommunicationCollaboration

Tools & Technologies

SemgrepCheckmarxBurp SuiteOWASP ZAPSnykDependabotBlack DuckAWS Secrets ManagerVaultTerraform

Certifications & Qualifications

OSCP

Industry Keywords

CVE HandlingBug Bounty ProgramAI/ML SecurityOAuth 2.0OIDCSAMLJWTPenetration TestingSupply-Chain SecurityCI/CD Security

Tech Stack

Tools & technologies

AWSAzureCloudPythonTerraformVault

About the role

Key responsibilities & impact

Lead threat modeling across products, features, and architecture changes
Translate threat-modeling findings into actionable security requirements
Own product security tooling end-to-end, including SAST, DAST, SCA, and secrets scanning
Select, integrate, tune, triage, and remediate product security tooling findings
Conduct hands-on security code and design reviews to identify vulnerabilities before release
Partner with R&D to secure new AI/ML features, including prompt injection, data exposure, and model misuse
Build security guardrails and secure coding guidelines for R&D teams
Own vulnerability intake and CVE handling, including responsible disclosure, triage, remediation, and CVE issuance
Coordinate external penetration tests through to closure
Launch and operate the bug bounty program, including platform selection, scope, rewards, and researcher relationships
Drive supply-chain and CI/CD security, including pipeline hardening, secrets management, SBOM generation, and dependency risk

Requirements

What you’ll need

5+ years of hands-on experience in application or product security at a software company or security vendor
Deep knowledge of OWASP Top 10 and web, API, and cloud vulnerability classes
Cryptography fundamentals, including key management, TLS, and hashing
Ability to validate vulnerabilities in real code
Hands-on experience with SAST tools such as Semgrep or Checkmarx
Hands-on experience with DAST tools such as Burp Suite or OWASP ZAP
Hands-on experience with SCA tools such as Snyk, Dependabot, or Black Duck
Practical threat modeling experience with a track record of making it useful for engineering teams
Strong understanding of OAuth 2.0, OIDC, SAML, and JWT and their security implications
Cloud-native security experience across AWS or Azure, including workloads, containers, serverless, and Terraform IaC
CI/CD pipeline security experience, including security gates and secrets management with Vault, AWS Secrets Manager, or similar
Python or Bash scripting for building security tooling and automating findings workflows
Hands-on use of AI coding and reasoning tools such as Claude, ChatGPT, Copilot, or Cursor in real production work
Clear communication and ability to drive remediation across engineering teams
CVE research, bug bounty hunting, or responsible disclosure track record (advantage)
Offensive security background, OSCP, CTF experience, or penetration testing certifications (advantage)
Depth in identity protocols, token flows, delegated trust patterns, and identity-related attack vectors (advantage)
Experience securing AI/ML features or pipelines (advantage)

Benefits

Comp & perks

Fast-moving team culture of innovation and collaboration
Opportunity to help reshape the future of identity security
Opportunity to work on AI/ML security, cloud-native security, and product security programs