Staff Product Security Engineer
$220k - $330k • Remote • New York • FullTime
Posted 3mo ago
About the job
As a Staff Software Engineer on the Product Security team at Harvey, you will be instrumental in embedding security into our AI platform from its inception. Given the sensitive nature of our customers' data, security is a top priority throughout the product lifecycle. You will take ownership of securing vital product components and spearhead high-impact security initiatives to elevate the security standards for the entire engineering organization. This role involves a blend of hands-on technical work, cross-functional leadership, and mentorship, offering a unique chance to shape and build a product security program within a rapidly scaling company. Our security approach is informed by extensive offensive security experience, including penetration testing and incident response, all while maintaining an engineering-first mindset.
Responsibilities
- Define and manage the product security roadmap, prioritizing initiatives based on risk, business impact, and engineering maturity.
- Establish and enhance the security posture across the engineering organization, creating scalable standards.
- Collaborate with Product Engineering, Infrastructure, and Platform teams to integrate secure design principles into all development stages.
- Own and review security-critical code in key product areas, including authentication and access control.
- Develop secure-by-default libraries and tools to simplify secure coding practices for developers.
- Lead mitigation strategies during security incidents, coordinating cross-functional teams.
- Mentor engineers and improve overall security awareness through code and design reviews, and technical guidance.
Requirements
- 8+ years of experience in product security, application security, offensive security, and/or security-focused software engineering.
- Proven track record of identifying and remediating software vulnerabilities (e.g., CVEs, bug bounty awards, published research).
- Demonstrated ability to lead complex, cross-functional security initiatives and achieve measurable improvements, influencing engineering teams without direct authority.
- Experience mentoring senior engineers and developing security talent within an engineering organization.
- Strong programming skills with experience in writing high-quality, production software.
- Excellent communication and collaboration skills, with the ability to translate security risks into business terms for non-security stakeholders.