Product Security Engineer II

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Product Security Engineer II based in Canada.

This role offers the opportunity to strengthen product security by partnering directly with engineering and product teams to build safer, more trusted applications. You will help identify security risks, improve vulnerability management processes, and develop scalable solutions that support secure product delivery. The position combines software engineering skills, security analysis, automation, and risk-based decision-making. You will work across teams to understand complex systems, recommend practical security improvements, and influence security outcomes. The ideal candidate is curious, technically minded, and passionate about applying offensive and defensive security practices in a product-focused environment. This remote opportunity is designed for an early-career security professional looking to grow expertise while making a meaningful impact on customer trust and platform resilience.

Accountabilities:: As a Product Security Engineer II, you will contribute to application security initiatives by working closely with engineering, product, infrastructure, compliance, and security teams. You will help identify vulnerabilities, improve security processes, and create tools and guidance that enable teams to build secure products efficiently.

Partner with product and engineering teams to identify application security risks and provide practical recommendations for mitigation.

Analyze application code, configurations, pull requests, logs, and technical documentation to identify potential security issues.

Contribute code changes, scripts, automation, tests, security checks, and tooling improvements to enhance security workflows.

Participate in Git-based development workflows, including code reviews, pull requests, issue tracking, and remediation discussions.

Evaluate vulnerabilities from internal testing, bug bounty programs, penetration tests, and security tools while prioritizing risks based on business impact.

Support vulnerability management activities including triage, validation, severity assessment, remediation tracking, and reporting.

Translate recurring security findings into scalable solutions such as secure coding guidelines, automation workflows, detection logic, and developer resources.

Review system designs, data flows, authentication models, authorization controls, and potential abuse scenarios.

Communicate security risks clearly to both technical and non-technical stakeholders, explaining impact, tradeoffs, and recommended actions.

Build strong relationships across engineering, product, compliance, infrastructure, and security teams.

Continue developing offensive security, defensive security, and software engineering skills through practical projects, research, certifications, and internal initiatives.

Requirements:

The ideal candidate is an early-career security professional with hands-on experience in software development, application security, or related technical fields. You should have strong curiosity, problem-solving abilities, and the ability to balance security requirements with product and business goals.

0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience.

Foundational programming experience with languages such as Python, JavaScript/TypeScript, Kotlin, or similar.

Ability to read, understand, and reason about unfamiliar codebases.

Experience using Git, GitHub, or similar version-control workflows, including branches, commits, pull requests, and code reviews.

Hands-on experience building, testing, securing, or analyzing software through professional work, internships, personal projects, labs, CTFs, bug bounty programs, or coursework.

Ability to write maintainable scripts or small programs to automate workflows, analyze data, validate findings, or improve security processes.

Understanding of common application security concepts, including OWASP Top 10 vulnerabilities, authentication and authorization issues, injection risks, insecure design, secrets management, dependency risks, and data protection.

Interest in offensive security practices such as web/API testing, security certifications, exploit development fundamentals, or security research.

Familiarity with vulnerability management concepts, including risk assessment, remediation tracking, false positives, and prioritization.

Ability to evaluate security risks based on likelihood, impact, and available mitigation options.

Strong product and engineering mindset with the ability to understand technical constraints and business priorities.

Excellent written and verbal communication skills with the ability to explain security concepts clearly.

Collaborative mindset with curiosity, humility, and a commitment to continuous learning.

Benefits:

Fully remote work opportunity.

Comprehensive health coverage with premiums fully covered for employees and dependents.

Flexible spending wallets for technology, food, lifestyle needs, and family-related expenses.

Competitive vacation and holiday schedules to support work-life balance.

Employee Stock Purchase Plan (ESPP) with discounted company shares.

Monthly stipends supporting health, wellness, and technology expenses.

Equity opportunities as part of a total compensation package.

Inclusive and supportive workplace focused on employee growth and development.

Opportunity to contribute to meaningful security initiatives that protect customers and strengthen product trust.

How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best!  Why Apply Through Jobgether?    Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.     #LI-CL1