Skip to content
jobs·jobs·jobs.com

Remote Product Security Engineer jobs

21 open positions in the United States, newest first.

Product security engineers secure the software a company builds and ships, as distinct from its corporate IT or its security operations center. They are responsible for finding and preventing vulnerabilities across the development lifecycle through design reviews, threat modeling, code review, security testing and tooling that developers will actually use.

About the Product Security Engineer role

What the work looks like

  • Review designs for new features and produce threat models that identify trust boundaries, abuse cases and required controls.
  • Audit code and pull requests for flaws such as injection, broken authorization and unsafe handling of secrets.
  • Run and tune static analysis, dependency scanning and fuzzing in the CI pipeline so findings are accurate and actionable.
  • Triage reports from penetration tests and bug bounty researchers, confirm impact and work with the owning team on a fix.
  • Build secure-by-default libraries and guardrails for authentication, cryptography and input handling that product teams can adopt.

What employers ask for

  • OWASP vulnerability classes for web and APIs
  • Threat modeling and secure design review
  • Code review in Go, Java, Python or similar
  • SAST, DAST and dependency scanning tools
  • Penetration testing with Burp Suite
  • Cloud and container security basics

Doing this job remotely

Code review, threat modeling and tooling work are all done in repositories, documents and video calls, so the role is frequently remote. Its effectiveness depends on relationships with engineering teams, which takes deliberate effort without hallway contact. Some employers run a security on-call rotation for vulnerability reports and incidents, and hardware or regulated products can require on-site work.

Where it comes from and where it leads

People typically come from software engineering with a security interest, or from penetration testing and application security consulting. The path continues to senior and staff product security engineer, security architect or management of an application security team.