Staff Product Security Engineer
$220k - $330k • Remote • San Francisco • FullTime
Posted 3mo ago
About the job
As a Staff Software Engineer on the Product Security team at Harvey, you will be instrumental in embedding security into our AI platform from its inception. Given the sensitive nature of our customers' data, security is a top priority throughout our product development lifecycle. You will take ownership of securing key product areas and lead high-impact security initiatives to elevate the security standards for the entire engineering organization. This role involves a blend of hands-on technical work, cross-functional leadership, and mentorship, offering a unique opportunity to define and build a product security program within a rapidly scaling company.
Responsibilities
- Define and own the product security roadmap, prioritizing initiatives based on risk, business impact, and engineering organization maturity.
- Establish and evolve the security posture across the engineering organization, setting scalable standards.
- Partner with Product Engineering, Infrastructure, and Platform teams to integrate secure design principles into all development stages.
- Own and review security-critical code in key product areas, including authentication and access control.
- Architect secure-by-default libraries and tools to simplify secure development practices for engineers.
- Lead mitigation strategies during security incident responses, coordinating cross-functional efforts.
- Mentor engineers and improve security practices across teams through code and design reviews, and technical guidance.
Requirements
- 8+ years of experience in product security, application security, offensive security, and/or security-focused software engineering.
- Proven track record of identifying and remediating software vulnerabilities (e.g., through CVEs, bug bounty awards, published research, or prior work).
- Demonstrated ability to lead complex cross-functional security initiatives and deliver measurable improvements, influencing engineering teams without direct authority.
- Experience mentoring senior engineers and developing security talent within an engineering organization.
- Strong programming skills with experience writing high-quality, production software.
- Excellent communication and collaboration skills, adept at translating security risks into business terms for non-security stakeholders.