[Hiring] Senior Product Security Engineer @Harness

Role Description

Product Security is responsible for ensuring the continuous security of Harness customer-facing products and internal tools. The team is focused on proactively discovering security weaknesses, driving and advising risk remediation, building a paved road for developers to adopt secure development practices, and developing partnerships with engineering and product teams to accelerate the release of software with security by design.

The Senior Product Security Engineer is a highly skilled practitioner who drives hands-on security work across the Harness platform. You will own technical security initiatives end-to-end, partner closely with engineering and product teams to identify and remediate vulnerabilities, and build tooling and processes that elevate the security bar across our development lifecycle. This role is for engineers who love to build, break, and secure complex systems.

What You Will Do

• Design and develop product security APIs, tools, and utilities for internal and external stakeholders.
• Conduct threat modeling and secure design reviews for application backend services and business integrations.
• Perform advanced penetration tests and adversarial attack simulations against Harness modules, APIs, and codebase using industry-standard frameworks.
• Lead manual and automated code review efforts to discover vulnerabilities, weaknesses, and anti-patterns in the Harness platform.
• Implement and operate security tooling including SAST, DAST, and SCA, and integrate these into CI/CD pipelines.
• Consult and advise developers and Product Managers on security standards, vulnerability remediation, and security architecture.
• Assess risks and trade-offs, and propose solutions for product security features such as authentication and authorization.
• Participate in the creation, review, and implementation of technical security standards across global engineering teams.
• Use the Harness platform to integrate security processes like vulnerability management into the SDLC.
• Collaborate cross-functionally with Engineering and Product to accelerate the release of software with security by design.

Qualifications

• BS in Computer Science or a related degree.
• 5+ years of relevant industry experience with a strong security focus.
• Solid experience with DevSecOps practices and secure SDLC methodologies.
• Good working knowledge of cyber security frameworks including OWASP, SANS, NIST, and CIS.
• Ability to describe software supply chain risks and Secure SDLC best practices.
• Experience with public or private cloud environments such as K8s, AWS, GCP, or Azure.
• Professional knowledge of enterprise applications, API development, and modern software delivery processes.
• Previous experience in a cloud-native environment.
• Proficiency in Java or a comparable language and object-oriented programming methodology.
• Hands-on experience with security testing tools and vulnerability management workflows.

Pay Transparency

$150,000 — $200,000 USD

Note on Fraudulent Recruiting/Offers

We have become aware that there may be fraudulent recruiting attempts being made by people posing as representatives of Harness. These scams may involve fake job postings, unsolicited emails, or messages claiming to be from our recruiters or hiring managers.

Please note, we do not ask for sensitive or financial information via chat, text, or social media, and any email communications will come from the domain @harness.io. Additionally, Harness will never ask for any payment, fee to be paid, or purchases to be made by a job applicant. All applicants are encouraged to apply directly to our open jobs via our website. Interviews are generally conducted via Zoom video conference unless the candidate requests other accommodations.

If you believe that you have been the target of an interview/offer scam by someone posing as a representative of Harness, please do not provide any personal or financial information and contact us immediately at [email protected]. You can also find additional information about this type of scam and report any fraudulent employment offers via the Federal Trade Commission’s website (https://consumer.ftc.gov/articles/job-scams), or you can contact your local law enforcement agency.