Senior Product Security Engineer

📋 Job Overview

Application Senior Product Security Engineer

🏢 About Tessera Labs

We're hiring a Senior Product Security Engineer to work hand-in-hand with developers to secure the product across its entire lifecycle. You'll be the person who makes our platform defensible — through design reviews, threat modeling, hands-on penetration testing, and secure-coding partnership — and you'll do it as a collaborator who helps engineers ship securely, not a gatekeeper who slows them down.

🎯 The Role

This role partners closely with product engineering and platform engineering teams.

✅ Key Responsibilities

• Partner directly with developers to secure the product across the Software Development Life Cycle (SDLC), embedding security early rather than bolting it on at the end.
• Lead security design and architecture reviews, and run threat modeling on new features and services.
• Perform hands-on penetration testing of web applications and Application Programming Interfaces (APIs), and translate findings into clear, prioritized, fixable work.
• Conduct secure code reviews and help define secure-coding standards and security acceptance criteria.
• Operate and tune Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and dependency / supply-chain scanning, and triage what they surface.
• Help engineers understand the \"why\" behind findings so the same class of issue doesn't recur.
• Contribute security evidence and rigor to our compliance posture (System and Organization Controls 2, or SOC 2, ISO 27001, etc.).

📌 Required Qualifications

• A strong track record in product or application security — you've measurably made real products more secure.
• Hands-on penetration testing experience against web applications and APIs.
• Deep understanding of how modern web applications work — single-page front ends, APIs, authentication and authorization (for example, OAuth 2.0 / OpenID Connect), sessions, and the common ways each is attacked (for example, the Open Worldwide Application Security Project, or OWASP, Top 10).
• Experience running security design reviews and threat modeling.
• Solid understanding of the SDLC and how to embed security into it.
• Strong communication skills — you work directly with developers and can explain risk in terms they'll act on.

⭐ Desirable Experience

• Familiarity with open-source security tooling (for example, OWASP ZAP and Burp Suite Community Edition for testing, Semgrep for SAST, Trivy or Grype for dependency and container scanning, Nuclei for templated scanning).
• A relevant offensive-security certification (for example, Offensive Security Certified Professional, or OSCP).
• Cloud security experience (Amazon Web Services, Microsoft Azure, or Google Cloud Platform) and container / Kubernetes security.
• Experience supporting a SOC 2, International Organization for Standardization (ISO) 27001, or similar program.
• Background in enterprise or regulated environments where deployment security is non-negotiable.

🎁 Benefits

Compensation: $50K – $60K

🛂 Visa & Eligibility

Remote in Brazil