Principal Product Security Engineer

Job not on LinkedIn

🔥 5 minutes ago

🏄 California – Remote

🏄 California – Remote

💵 $265k - $320k / year

⏰ Full Time

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Cribl

WebsiteLinkedInAll Job Openings

501 - 1000 employees

Founded 2017

☁️ SaaS

SaaS • Cloud

Cribl is a company providing a cloud-based service, allowing users to manage and analyze their data through a web application. The service includes features for user accounts and integration with Google for authentication.

📋 Description

• Set long-term product and cloud security direction across multiple teams • Lead Product Security Reviews for distributed, multi-tenant SaaS and customer-managed products • Perform architecture and design reviews, threat modeling, abuse-case analysis, targeted secure code review, and security test planning • Translate risk into engineering requirements, mitigations, tests, and secure defaults; verify intended risk reduction • Serve as a principal cloud security authority across IAM, workload identity, network exposure, KMS, encryption, secrets, logging, detection, containers, Kubernetes, serverless services, infrastructure as code, hardening, and data isolation • Lead the Product Security component of FedRAMP engineering and translate FedRAMP Moderate and NIST SP 800-53 control intent into technical controls and evidence • Partner on authorization-boundary and significant-change decisions, continuous monitoring, vulnerability and change management, POA&M and deviation remediation, incident response, vendor assessments, and assessor interactions • Investigate vulnerabilities and ambiguous signals from bug bounty, scanners, penetration tests, cloud detections, and internal reports • Determine exploitability, exposure, and impact; coordinate remediation; validate fixes and bypasses; and hunt for variants and root causes • Evolve risk-adaptive vulnerability management using exposure, exploitability, CISA Known Exploited Vulnerabilities signals, asset criticality, customer impact, and regulatory timelines • Build and operate security capabilities and developer paved roads across CI/CD, SAST, SCA, secrets, infrastructure as code, containers, cloud posture, and testing • Automate repeatable security work while preserving human judgment for consequential decisions • Scope and oversee external penetration tests, purple-team exercises, and security vendors • Lead multi-team work through uncertainty and high-stakes situations, balancing security, reliability, delivery, customer impact, and compliance • Communicate complex risks, options, uncertainty, and recommendations to engineers, senior leaders, customers, assessors, and external partners • Mentor Product Security engineers, security champions, and engineering partners • Create standards, runbooks, automation, and continuity plans • Evaluate and responsibly apply emerging technologies, including AI-assisted security engineering • Perform stand-by, on-call, or off-hours duties

🎯 Requirements

• Typically 10+ years of relevant software security, security engineering, or software engineering experience, or equivalent demonstrated scope and impact • Substantial hands-on Application Security or Product Security and cloud security work • Experience securing AI or agentic systems and applying AI responsibly to security engineering workflows • Principal-level track record of setting technical direction across teams, leading multi-quarter initiatives, resolving ambiguous critical problems, and influencing senior Engineering and Product leaders without direct authority • Deep, hands-on AWS and Azure security experience in production SaaS or cloud-native systems • Experience with identity and authorization, network controls, encryption and key management, secrets, logging and detection, containers or Kubernetes, serverless services, infrastructure as code, and multi-tenant data isolation • Direct experience implementing or operating product and cloud security controls in a FedRAMP-authorized or FedRAMP-bound environment • Understanding of NIST SP 800-53 control intent and experience with technical control implementation and evidence, continuous monitoring, vulnerability and change management, POA&M or deviation remediation, and assessor interactions • Expertise leading security design reviews and threat models for complex applications, APIs, distributed systems, and cloud architectures • Strong knowledge of web and application vulnerabilities, exploit techniques, OWASP guidance, authentication and authorization protocols, cryptography, common network protocols, and secure cloud operating models • Ability to read production code and build maintainable automation in JavaScript or TypeScript, Python, Go, or a comparable language • Hands-on vulnerability-response experience, including exploitability analysis, root-cause and variant analysis, remediation design, fix and bypass validation, stakeholder coordination, and incident support • Exceptional written and verbal communication • A bachelor’s degree in computer science, cybersecurity, or a related field—or equivalent practical experience • Stand-by, on-call, or off-hours availability

🏖️ Benefits

• Health insurance • Dental insurance • Vision insurance • Short-term disability insurance • Life insurance • Paid holidays • Paid time off • Fertility treatment benefit • 401(k) • Equity • Cribl Corporate Bonus Program

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume