Product Security Engineer

Overview:

The Product Security Engineer helps keep Harness software secure across the development lifecycle, with a strong focus on the day-to-day work that keeps product security moving: customer security escalations, incoming security alerts, and vulnerability management from triage through remediation.

This role partners with engineering to find, prioritize, and fix vulnerabilities; run and tune scanners such as Semgrep, Snyk, and Prisma Cloud; and fold security checks into CI/CD so issues are caught before they ship. It also drives internal adoption of Harness security modules (STO, SCS, and related platform capabilities) so we use our own product the way customers should, and so shift-left and software supply-chain practices stick across teams.

Key Responsibilities

• Own daily product-security operations, triage customer security escalations, investigate security alerts, and drive vulnerability management to closure with clear owners, SLAs, and status.
• Lead identification, triage, and remediation of vulnerabilities across the Harness platform and modules, partnering with engineering to track progress and unblock fixes.
• Operate and improve SAST/SCA and cloud/container scanning with tools such as Semgrep, Snyk, and Prisma Cloud (and equivalents), including tuning rules, reducing noise, and keeping reporting consistent.
• Integrate security controls into CI/CD (Harness, GitHub Actions, or similar) so scans, gates, and supply-chain checks run as part of the pipeline, not as an afterthought.
• Promote and implement Harness STO and SCS internally: define adoption strategy, land the workflows on real pipelines, and use internal usage as the reference for customer-facing best practice.
• Support release security advisories by helping produce and review customer-facing vulnerability summaries for product and platform releases.
• Establish and maintain software supply-chain practices (dependency management, artifact integrity, SLSA-oriented controls) and stay current on emerging supply-chain threats.
• Plan and support periodic penetration tests with internal teams and external testers; use findings to validate and strengthen controls.
• Evaluate and recommend security tools to close coverage gaps; automate vulnerability management and reporting so response time and visibility stay high.
• Partner with incident response on product-related security incidents; support compliance work with audit-ready evidence.
• Apply the OWASP Top 10 (and API/LLM-adjacent variants where they apply) when triaging findings, reviewing designs, and advising teams on what actually matters versus scanner noise.
• Enable engineering, platform, and DevOps teams through practical training so security is treated as part of delivery, not a separate queue.

Qualifications

• Proven experience in product security, vulnerability management, and secure software development lifecycle practices.
• Hands-on expertise with security tools such as OWASP ZAP, Burp Suite, Snyk, Prisma Cloud, Semgrep, or equivalent.
• Strong understanding of CI/CD processes, tools (e.g., Jenkins, GitHub Actions, Harness), and shift-left security approaches.
• Knowledge of secure coding practices, threat modeling methodologies, and supply chain security principles.
• Working knowledge of the OWASP Top 10 and how to map it to real product issues (injection, broken access control, SSRF, insecure design, etc.), not only the list by name.
• Familiarity with AI security concerns in both the SDLC (AI-generated code, Copilot/Cursor-style tools) and the product (LLM apps, agents): prompt injection, sensitive-data exposure, insecure plugin/tool use, and basic OWASP LLM Top 10 awareness.
• Familiarity with different types of security testing (SAST, DAST, IaC, SCA) and proficiency in evaluating scanning tools.
• Strong collaboration skills with engineering and DevOps teams to embed security practices effectively.
• Passion for fostering a security-first culture through enablement, training, and continuous improvement.
• Excellent communication skills to convey technical security concepts to diverse stakeholders.
• Working knowledge of cloud environments (AWS, GCP, or Azure) and securing containerized applications (Docker, Kubernetes).
• Experience scripting or automating security workflows using Python, Go, or similar languages.