{bc}
Apply
workable

Principal or Staff Product Security Engineer

Skylight
Remote, USA
Senior · 6+ years experience
Remote
Discovered 6 days ago

Full Job Posting

Requirements

  • 6+ years in application or product security, with a software engineering background. You can ship production code, not just review it.
  • Deep experience securing backend services and APIs, including OAuth 2.0/OIDC, PKCE, MFA, session management, and token handling.
  • Experience building and maintaining security tooling and automation (static analysis, CI integrations, custom scanners), and comfort working with LLM-based systems.
  • Hands-on experience running or triaging a bug bounty program.
  • A track record of getting engineering teams to prioritize and fix security issues through influence and good judgment, not escalation.
  • Clear written communication and the ability to explain risk to both engineers and non-technical stakeholders.
  • Nice to have
  • Mobile application security experience (OWASP MASVS), ideally including shipping fixes in a mobile codebase.
  • Android platform or app security experience.
  • Experience assessing AI/LLM features for risks like prompt injection and data leakage.
  • Familiarity with children's privacy requirements (e.g. COPPA) or other sensitive consumer data.
  • Exposure to embedded, IoT, or firmware security.
  • Familiarity with the EU Cyber Resilience Act or UK PSTI.
  • Incident response experience.

Benefits

  • Our competitive compensation package includes:
  • Competitive Salary + Equity Package
  • 401K matching
  • Wellness, learning, and home-office budgets
  • Health, Dental & Vision Medical Plans
  • Tremendous autonomy to set the direction of your work
  • Unlimited PTO
  • Company holidays on the first Friday of every month (Except November, December. & January)
  • The anticipated base salary range for this position is $200K-250K per year. This range reflects the compensation Skylight reasonably and in good faith expects to pay for the position at the time of posting. Actual compensation will be determined based on job-related factors, which may include experience, qualifications, skills, education, geographic location, and internal equity. Skylight also offers benefits, including medical, dental, vision, and paid time off.
  • Equal Employment Opportunity
  • Skylight is an equal opportunity employer committed to building a diverse and inclusive team. All qualified applicants will be considered for employment without regard to race, color, religion, sex, national origin, age, disability, genetic information, or any other characteristic protected by applicable federal, state, or local law. Pursuant to the San Francisco Fair Chance Ordinance, Skylight will consider for employment qualified applicants with arrest and conviction records.

Preferred Qualifications

  • Mobile application security experience (OWASP MASVS), ideally including shipping fixes in a mobile codebase.
  • Android platform or app security experience.
  • Experience assessing AI/LLM features for risks like prompt injection and data leakage.
  • Familiarity with children's privacy requirements (e.g. COPPA) or other sensitive consumer data.
  • Exposure to embedded, IoT, or firmware security.
  • Familiarity with the EU Cyber Resilience Act or UK PSTI.
  • Incident response experience.

Responsibilities

  • Own the vulnerability management pipeline end to end: intake, triage, prioritization, and driving fixes to closure against defined remediation SLAs across Backend, Mobile, and Android teams.
  • Join our Platform pod where, with the team, you’ll write and ship security fixes directly in our codebases.
  • Own and evolve our AI security scanning and verification pipeline. Tune it to reduce false positives, extend coverage to new repositories, and integrate it into CI.
  • Run our HackerOne bug bounty program: triage reports, validate findings, work with researchers, decide on payouts, and manage the vendor relationship.
  • Manage third-party penetration testing engagements from scoping through remediation.
  • Lead security design reviews and threat modeling for new features and products, including AI/LLM-powered features and products that handle children's data.
  • Review and advise on device and firmware security work led by our firmware team.
  • Provide metrics and data on findings, remediation, and SLA adherence to support compliance and leadership reporting.
  • Serve as a subject matter expert during product security incidents.

Apply for this job in 1 click

Skip the repetitive application forms

Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.

Sarah M.James T.Maya R.

Trusted by over 500,000 job seekers on Base Career

Start Free Today

More from this employer

More jobs at Skylight

Senior/Staff Security Engineer (U. S. Air Force)

, USA

Discovered 2 days agoFull-time

Senior/Staff Software Engineer, Testing (U.S. Air Force)

, USA

Discovered 2 days agoFull-time

Senior/Staff DevOps Engineer (U.S. Air Force)

, USA

Discovered 2 days agoFull-time

Senior/Staff/Principal Software Engineer, Legacy Modernization (U.S. Air Force)

, USA

Discovered 2 days agoFull-time

Senior/Staff Data Scientist (ACF)

, USA

Discovered 2 days agoFull-time

Senior/Staff Product Manager, Technical (ACF)

, USA

Discovered 2 days agoFull-time

3PL Manager

, USA

Discovered 2 days agoFull-time

Ecommerce Demand Planner

Seattle, USA

Discovered 2 days agoFull-time