Product Security Engineer

Overview:

The Product Security Engineer helps keep Harness software secure across the development lifecycle, with a strong focus on the day-to-day work that keeps product security moving: customer security escalations, incoming security alerts, and vulnerability management from triage through remediation.

Key Responsibilities

• Own daily product-security operations, triage customer security escalations, investigate security alerts, and drive vulnerability management to closure with clear owners, SLAs, and status.
• Lead identification, triage, and remediation of vulnerabilities across the Harness platform and modules, partnering with engineering to track progress and unblock fixes.
• Operate and improve SAST/SCA and cloud/container scanning with tools such as Semgrep, Snyk, and Prisma Cloud (and equivalents), including tuning rules, reducing noise, and keeping reporting consistent.
• Integrate security controls into CI/CD (Harness, GitHub Actions, or similar) so scans, gates, and supply-chain checks run as part of the pipeline, not as an afterthought.
• Promote and implement Harness STO and SCS internally: define adoption strategy, land the workflows on real pipelines, and use internal usage as the reference for customer-facing best practice.
• Support release security advisories by helping produce and review customer-facing vulnerability summaries for product and platform releases.
• Establish and maintain software supply-chain practices (dependency management, artifact integrity, SLSA-oriented controls) and stay current on emerging supply-chain threats.
• Plan and support periodic penetration tests with internal teams and external testers; use findings to validate and strengthen controls.
• Evaluate and recommend security tools to close coverage gaps; automate vulnerability management and reporting so response time and visibility stay high.
• Partner with incident response on product-related security incidents; support compliance work with audit-ready evidence.
• Apply the OWASP Top 10 (and API/LLM-adjacent variants where they apply) when triaging findings, reviewing designs, and advising teams on what actually matters versus scanner noise.
• Enable engineering, platform, and DevOps teams through practical training so security is treated as part of delivery, not a separate queue.

Qualifications

• Proven experience in product security, vulnerability management, and secure software development lifecycle practices.
• Hands-on expertise with security tools such as OWASP ZAP, Burp Suite, Snyk, Prisma Cloud, Semgrep, or equivalent.
• Strong understanding of CI/CD processes, tools (e.g., Jenkins, GitHub Actions, Harness), and shift-left security approaches.
• Knowledge of secure coding practices, threat modeling methodologies, and supply chain security principles.
• Working knowledge of the OWASP Top 10 and how to map it to real product issues (injection, broken access control, SSRF, insecure design, etc.), not only the list by name.
• Familiarity with AI security concerns in both the SDLC (AI-generated code, Copilot/Cursor-style tools) and the product (LLM apps, agents): prompt injection, sensitive-data exposure, insecure plugin/tool use, and basic OWASP LLM Top 10 awareness.
• Familiarity with different types of security testing (SAST, DAST, IaC, SCA) and proficiency in evaluating scanning tools.
• Strong collaboration skills with engineering and DevOps teams to embed security practices effectively.
• Passion for fostering a security-first culture through enablement, training, and continuous improvement.
• Excellent communication skills to convey technical security concepts to diverse stakeholders.
• Working knowledge of cloud environments (AWS, GCP, or Azure) and securing containerized applications (Docker, Kubernetes).
• Experience scripting or automating security workflows using Python, Go, or similar languages.