Staff Product Security Engineer

🔥 13 hours ago

🌐 Mexico, Brazil – Remote

🇲🇽 Mexico – Remote 🇧🇷 Brazil – Remote

⏰ Full Time

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 11%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.Why this score:

• Open for 1 day.
• Jobs at this company usually fill in 42 days.
• No salary listed.

Apply Now

Check your resume score

Customize resume + cover letter

Find Similar Remote Jobs

☆ Save☑️ Mark as applied❌ Hide

Report problem

Guidewire Software

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2001

🛡️ Insurance

💰 $750k Series C on 2008-03

Software • Insurance • Cloud Computing

Guidewire Software is a leading provider of software solutions for the property and casualty (P&C) insurance industry. The company offers a comprehensive platform that includes core applications such as PolicyCenter, ClaimCenter, and BillingCenter, as well as advanced analytics and a robust cloud platform. Guidewire focuses on delivering digital transformations, improving operational efficiencies, and enhancing customer service for insurers globally. Through collaborations and partnerships, Guidewire supports a wide range of insurance products and services, including usage-based and embedded insurance. With its commitment to innovation and customer success, Guidewire continues to empower insurers to meet the evolving demands of the industry.

📋 Description

• Lead penetration testing across Guidewire’s products • Plan and perform penetration tests of web applications, APIs, cloud services, integrations, multi-tenant SaaS environments, and AI/ML-powered product features • Identify, validate, reproduce, risk-rate, and retest vulnerabilities; provide actionable remediation guidance • Develop penetration-testing tooling, scripts, automation, and evaluate AI-assisted and autonomous testing tools • Own the pen testing schedule across the product release lifecycle and ensure products are tested before key release milestones • Define testing scope, rules of engagement, environments, and access for vendor engagements • Align product teams, implementation partners, and vendors on testing responsibilities • Manage vendor relationships, statements of work, kickoffs, status tracking, report quality reviews, and escalations • Manage the penetration-testing budget, vendor costs, forecasting, and utilization • Review vendor reports, remove false positives, and consolidate findings into vulnerability management • Evaluate vendor performance and recommend methodology or vendor changes • Ensure testing meets SOC 2, ISO 27001, PCI DSS, and customer contractual requirements • Maintain pen test evidence, attestation letters, and executive summaries for auditors and customers • Track remediation against SLAs and report status, risk, and program metrics to product, engineering, and security leadership • Respond to customer security questions about testing practices and results • Support PSIRT activities including vulnerability triage, root cause analysis, incident coordination, security releases, code and design reviews, and validation of SAST, DAST, SCA, and container scanning findings

🎯 Requirements

• Bachelor's or master's degree in computer science, or equivalent experience • 7+ years of application or product security experience, including at least 5 years of hands-on penetration testing of web applications, APIs, and cloud-hosted services • Proven experience managing third-party pen testing vendors, including scoping, scheduling and report review • Hands-on experience testing applications hosted on AWS, including IAM and multi-tenant architectures • Working knowledge of compliance requirements for pen testing, such as SOC 2, ISO 27001, or PCI DSS • Solid understanding of the OWASP Top 10, OWASP API Security Top 10, OWASP Top 10 for LLM Applications, and common product vulnerability classes • Hands-on experience with pen testing tools such as Burp Suite, along with SAST, DAST and vulnerability scanning tools • Experience risk-rating vulnerabilities with CVSS • Scripting skills (Python, Shell, or similar) to build testing tools and automation • Strong written and verbal communication skills, including the ability to write clear pen test reports for engineers, executives, and customers • Proven ability to build relationships and influence people at all levels, as well as vendors and external partners • Industry certifications such as OSCP, OSWE, GPEN, GWAPT, CSSLP, or CISSP are nice to have • Experience testing AI/LLM applications in production is nice to have • Bug bounty participation or published security research is nice to have • Knowledge of the security research community is nice to have • Development experience in Java, C++ or Python is nice to have • Experience in a PSIRT or product incident response role is nice to have • Experience with insurance, financial services, or other regulated SaaS products is nice to have

🏖️ Benefits

• Equal opportunity and affirmative action employer • Disability-inclusive employer • Individualized accommodations and support throughout the hiring process

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume