Senior Product Security Engineer (Contract)

We're seeking a highly technical Senior Product Security Engineer for a 6-month contract (40 hours/week) to embed security into the product development lifecycle. This is a hands-on engineering role responsible for identifying security risks early, partnering with development teams on remediation, conducting security reviews, performing application security testing, and helping build secure-by-design products.

This role will work closely with Engineering, Cloud Security, Infrastructure, Compliance, and Product Management to ensure security is integrated throughout the SDLC while enabling developer velocity.

Application Security

Perform security design and architecture reviews for new products and features.

Conduct threat modeling for applications, APIs, and AI-enabled services.

Review application security posture throughout the SDLC.

Partner with engineering teams to prioritize and remediate vulnerabilities.

Review authentication, authorization, and access control implementations.

Security Testing

Perform manual web, API, thick-client, and mobile application penetration testing.

Validate findings from third-party penetration tests.

Conduct secure code reviews.

Verify remediation of security vulnerabilities.

Secure Development

Drive adoption of secure coding practices.

Partner with developers to improve security throughout the SDLC.

Help define Product Security standards and engineering guardrails.

Develop reusable security patterns and reference architectures.

Vulnerability Management

Triage findings from SAST, DAST, SCA, container scanning, and cloud security tools.

Work with engineering teams to prioritize remediation.

Track remediation SLAs and security metrics.

AI Security

Assess AI-enabled products for security risks.

Review LLM integrations and AI workflows.

Test AI applications for prompt injection, data leakage, insecure tool use, model abuse, and authorization weaknesses.

Help define secure AI engineering standards.

Security Automation

Improve automation of security testing throughout CI/CD.

Integrate security tooling into developer workflows.

Build scripts and tooling that reduce manual security work.

Cross-functional Partnership

Collaborate with Product, Engineering, Infrastructure, Cloud Security, and Compliance teams.

Support customer security questionnaires related to product security.

Assist Sales Engineering with security discussions when needed.

5+ years in Product Security or Application Security.

Strong understanding of modern application architectures.

Experience securing:

Web applications

APIs

Microservices

Cloud-native applications

Experience performing threat modeling.

Experience conducting penetration testing.

Strong understanding of:

OWASP Top 10

OWASP API Top 10

Authentication & Authorization

OAuth / OIDC

Secure SDLC

Experience with SAST, DAST, SCA, and container security.

Experience partnering directly with engineering teams.

Strong written and verbal communication skills.

Experience securing AI/LLM applications.

Experience with Kubernetes and containers.

Familiarity with cloud security (AWS, Azure, or GCP).

Experience with GitHub Actions or CI/CD security.

Experience using:

Snyk

Burp Suite Pro

Semgrep

Wiz

GitHub Advanced Security

Security certifications such as OSCP, GWAPT, GWEB, CSSLP, or CISSP are a plus

• Competitive salary

• 100% individual and dependent medical + dental + vision coverage

• 401(K) with 4% company match

• 20 days PTO

• Iru Wellness Week the first week in July

• Equity for full-time employees

• Up to 16 weeks of paid leave for new parents

• Paid Family and Medical Leave

• Exciting opportunities for career growth

We are excited to be serving a significant need for a fast-growing market, and are proud of the high-performing team we have brought together so far. If you’re someone who wants to engage in new, exciting projects that will challenge your skills in the best way possible, we would love to connect with you.

At Iru, we believe in fostering an inclusive environment in which employees feel encouraged to share their unique perspectives, leverage their strengths, and act authentically. We know that diverse teams are strong teams, and welcome those from all backgrounds and varying experiences.

Iru is proud to be an equal opportunity employer committed to diversity and inclusion in the workplace. Qualified applicants will be considered for employment without regard to race, color, religion, national origin, age, sex, sexual orientation, gender identity, physical or mental disability, protected veteran or military status or any other status protected by applicable law.