Staff Product Security Engineer, Secure SDLC and AI Development
Venture-backed, remote-first software company that delivers hardened open-source builds
| Employer | Venture-backed, remote-first software company that delivers hardened open-source builds (not named) |
|---|---|
| Location | Remote (U.S.) · Remote |
| Type & level | Full-time · Staff |
| Pay | USD 205k–231k base Source: pay range stated in the source posting |
| Visa path | O-1A fit (senior candidates) |
| Role family | Cloud & Infrastructure Security Architect |
About the role
This staff role drives product security across several products and engineering teams, with a strong focus on securing AI-assisted development. The engineer sets guardrails, tooling and review practices so teams can ship quickly while using AI responsibly. It is hands-on and relies on influencing teams without direct authority.
What you'll do
- Set product security strategy and carry it out across multiple products and teams.
- Evolve the secure development lifecycle, especially controls for AI-assisted coding.
- Lead architecture reviews and threat modeling for high-impact systems.
- Automate vulnerability detection, triage and remediation, including policy-as-code and cloud and container controls.
- Bring static, dynamic, dependency and infrastructure-as-code scanning into CI/CD workflows.
- Turn SOC 2, ISO 27001, NIST and SLSA requirements into automated engineering controls and mentor other security engineers.
Requirements
- 7+ years in software, product, application or cloud security.
- Experience taking security programs such as secure SDLC or platform hardening from design to rollout.
- Hands-on familiarity with containers, Kubernetes and public cloud security controls.
- Experience with compliance frameworks such as SOC 2, ISO 27001, NIST or SLSA.
- Ability to automate security workflows in Go, Python or Shell and integrate with CI/CD.
- Strong written and verbal communication in a remote-first setting.
Nice to have
- Experience designing or running an AI security or governance program for AI-assisted development.
- Background in software supply-chain security such as SBOMs, provenance and signing.
- Red-teaming or offensive security experience.
- Experience with SAST, DAST, SCA or IaC scanning tools.
- Public speaking, writing or standards-body participation on security topics.
Pay & benefits
USD 205k–231k base. The posting lists stock options at hire and promotion, fully covered health, vision and dental premiums, flexible time off, a remote work stipend and paid parental leave of 12 to 18 weeks.
Pay source: pay range stated in the source posting. Market data, not an offer from O1DMatch.
Visa path
Senior security engineers often build O-1A evidence from conference talks, published writing, open-source security contributions, standards-body participation, high compensation and recognition by peers. The posting states no citizenship restriction. An employer like this or a U.S. agent can file the petition; approval depends on the individual's evidence.
How to get matched
- Take the free eligibility checkAn AI review of your background against the eight O-1 criteria, at check.o1dmatch.com.
- Create your profile with code WORKWITHUSIt unlocks the Starter plan at no cost. Tell us your field and the work you do today.
- Upload your evidenceEach document is sorted under the criterion it supports, and your criteria map shows what is still missing.
- Get matchedWe match strong profiles with U.S. employers hiring for roles like this one. Gigs you confirm with verified companies count toward your itinerary, and at a score of 75 we connect you with an immigration attorney.
This listing describes a real U.S. posting so you can see what employers ask for. O1DMatch does not represent that employer and does not hold this opening; applying matches you with employers hiring for this kind of role. No visa outcome is promised.