Senior Software Engineer, Product Security

• Define and drive the product security best practices across product teams.
• Mentor and guide junior security engineers and cross-functional teams on secure development practices.

• Perform threat modeling exercises for new and existing products to identify potential security vulnerabilities.
• Develop and implement effective mitigation strategies in collaboration with product and engineering teams.

• Integrate security best practices into the Software Development Lifecycle (SDLC) and infrastructure design.
• Work closely with development and operations teams to design security into products from inception through deployment.

• Perform comprehensive security testing, including code reviews, penetration testing, fuzz testing, and the development of automated security tools.

• Manage and enhance our bug bounty programs and third-party security testing initiatives, engaging with platforms such as Bugcrowd.
• Evaluate vulnerability reports from external researchers, prioritize remediation efforts, and clearly communicate findings to relevant stakeholders.

• Support compliance efforts to align with industry standards and regulations (e.g., SOC2, GLBA, etc) while driving continuous improvement in security processes and policies.
• Assess and improve the security posture of supporting infrastructure and third-party integrations.
• Stay current with emerging security trends and technologies, integrating them into our security framework as appropriate.

• Participate in security incident response efforts, conduct root cause analyses, and coordinate remediation across teams in partnership with Security operations.

• Bachelor's or Master's degree in Computer Science, Cybersecurity, or a related field.
• 5+ years of experience in product or application security with demonstrable expertise in secure software development and infrastructure security. (Strong preference for candidates who have been a Software Engineer and/or have experience building software applications.)
• Deep understanding of threat modeling, risk management, and vulnerability assessment methodologies.
• Experience with secure API development, microservices security, and addressing emerging infrastructure security challenges.
• Proficiency in multiple programming languages (e.g., Python, Django, Java, JavaScript) and familiarity with secure coding practices and frameworks such as OWASP SAMM.
• Hands-on experience with security tools and experience integrating automated security testing into CI/CD pipelines.
• Excellent leadership, communication, and collaboration skills, with the ability to work effectively across diverse teams.

• Familiarity with cloud security best practices and container security technologies.
• Proven experience managing bug bounty programs and working with platforms such as Bugcrowd.
• Demonstrated track record in leading security initiatives within fast-paced, innovative environments

• We are an equal opportunity employer and are committed to providing a positive interview experience for every candidate. If accommodations due to a disability or medical condition are needed, please connect with the talent partner via email.
• Carta uses E-Verify in the United States for employment authorization. See the

Carta