Product Security Engineer
To apply, save or open the job page, sign in. Sign-up is by invitation only for now, and after signing in you come straight back to this job. No invite? Ask to join
Summary
Silverfort is on a mission to bring identity security everywhere – to every human, machine, and AI agent, both on-premises and in the cloud.
Requirements
- 5+ years of hands-on experience in application or product security at a software company or security vendor
- Deep knowledge of OWASP Top 10 and web, API, and cloud vulnerability classes, plus cryptography fundamentals (key management, TLS, hashing), with the ability to validate vulnerabilities in real code
- Hands-on experience with SAST (Semgrep, Checkmarx, or similar), DAST (Burp Suite, OWASP ZAP), and SCA (Snyk, Dependabot, or Black Duck)
- Practical threat modeling experience, with a track record of making it useful for engineering teams
- Strong understanding of OAuth 2.0, OIDC, SAML, and JWT, and the security implications of each
- Cloud-native security across AWS or Azure - workloads, containers, serverless, and IaC (Terraform) - and CI/CD pipeline security, including security gates and secrets management (Vault, AWS Secrets Manager, or similar)
- Python or Bash scripting for building security tooling and automating findings workflows
- Hands-on use of AI coding and reasoning tools (Claude, ChatGPT, Copilot, Cursor, and similar) in real production work - using them to ship faster and to higher quality, not just to experiment
- Clear communication and the ability to drive remediation across engineering teams
- CVE research, bug bounty hunting, or a track record of responsible disclosure (advantage)
- Offensive security background - OSCP, CTF experience, or penetration testing certifications (advantage)
- Depth in identity protocols: token flows, delegated trust patterns, and identity-related attack vectors (advantage)