Lead Product Security Engineer

Lead Product Security Engineer

Location: Chennai, India (Hybrid)

Job Summary

Profile Summary

The Product Vulnerability Management Engineer supports the execution of the enterprise product vulnerability management program. Reporting to the Senior Product Vulnerability Manager, this role works with development, Information Security, and product security teams to identify, triage, track, and remediate product vulnerabilities in line with established processes, risk frameworks, and service-level expectations.

Responsibilities

• Review and triage vulnerabilities identified through security scanning tools, penetration tests, external reports, and internal security assessments.
• Work with Information Security, Development, DevOps, and Product Security teams to validate findings, determine ownership, and coordinate remediation.
• Track vulnerabilities from intake through closure, including remediation status, due dates, validation evidence, and exceptions.
• Apply established vulnerability-severity and prioritization frameworks, considering CVSS, application criticality, exposure, data sensitivity, exploitability, and customer impact.
• Follow up with development teams on remediation progress and escalate overdue, blocked, urgent, or critical items to the appropriate stakeholders.
• Participate in emergency response calls for urgent and critical vulnerabilities; document actions, owners, deadlines, and closure evidence.
• Familiarity with application-security tooling and workflows, including integration of SAST, SCA, and secret scanning into CI/CD pipelines.
• Hands-on experience reviewing and triaging findings from SAST, SCA, secret scanning/secret-management tools, and penetration tests.
• Understanding of dependency vulnerabilities, exposed secrets, common application vulnerabilities, and remediation best practices.
• Experience supporting penetration-test finding validation, tracking, and remediation with development teams.
• Assist with coordinated vulnerability disclosure activities, including intake tracking, communications support, vulnerability validation, and documentation.
• Maintain accurate records in vulnerability-management, ticketing, and reporting systems.
• Support vulnerability metrics and dashboards, including SLA compliance, backlog, remediation aging, and finding trends.
• Help maintain playbooks, standard operating procedures, knowledge articles, and training materials.
• Support SBOM-related vulnerability monitoring and response for third-party and open-source components.
• Identify recurring issues, process gaps, or tooling problems and recommend improvements to the team.

Preferred Qualifications

• Exposure to PSIRT or coordinated vulnerability disclosure processes.
• Familiarity with SBOMs, open-source dependency risks, and software supply-chain security.
• Basic scripting or data-analysis skills using Python, SQL, PowerShell, or similar tools.
• Experience in a regulated, enterprise, cloud, IoT, or connected-product environment.
• Certifications such as Security+, CEH, GIAC, or comparable credentials.

Education And/Or Qualification

• 8-10 years of experience in application security, product security, vulnerability management, security engineering, or a related discipline.
• Practical experience with vulnerability-management processes, including triage, remediation tracking, and closure validation.
• Working knowledge of common application-security vulnerabilities and OWASP principles.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.