[Hiring] Staff Product Security Engineer @UpGuard Inc.

Role Description

This is UpGuard's first dedicated product security hire. You'll have significant ownership over the direction of product security at UpGuard as we scale. You won't be inheriting someone else's decisions. You'll be defining the security standards, tooling, and practices that protect UpGuard's products and infrastructure for years to come.

In this role, you'll work across our product and production environments:

• Performing security reviews
• Managing vulnerabilities
• Running detection and response operations in our cloud-native infrastructure

You'll collaborate closely with our product engineering and platform teams to secure our products, CI/CD pipelines, and production systems, and to embed security into how we build from the ground up.

The full remit of product security is broad, so we've been deliberate about sequencing. In your first 6–12 months you'll:

• Refresh threat modelling and security review as a standard part of how we ship
• Figure out where AI actually helps in AppSec (code review, triage, coverage) and build what works
• Harden our GCP and Kubernetes baseline and get secure-by-default configs into infrastructure-as-code

The function sits at the heart of our engineering organisation, and you'll have genuine autonomy and influence: defining the security roadmap, driving best practices, and scaling our security posture as we grow.

This is a Staff-level individual contributor role.

Qualifications

• 7+ years of experience in security engineering and/or software engineering/or security operations
• Work in cloud environments, with a focus on:
• Cloud security experience (GCP preferred, but AWS or Azure is welcome)
• Cloud native Kubernetes services (EKS/GKE/AKS) and strong container security principles
• Strong understanding of securing IAM and cloud identities
• Experience leading technical security reviews of products and architectures
• Strong knowledge of common web application vulnerabilities and how to prevent them (OWASP Top 10 and similar)
• Hands-on experience with IAC and related tools (preferably Terraform/OpenTofu)

Requirements

• Experience as the first security hire or founding member of a security function at a scaling company
• Familiarity with AI/LLM security risks (e.g. OWASP LLM Top 10) and securing AI-powered product features
• Strong backend engineering skills, particularly in Go
• Experience supporting SOC 2 / ISO 27001 audits from an engineering perspective
• Public security research, CVEs, open-source security tooling, or conference talks
• Offensive security skills, with the ability to validate findings through hands-on exploitation

Benefits

• WFH set-up allowance: To ensure you have the right environment to work in, we will help you get set up within your first 3 months at UpGuard
• Monthly Lifestyle subsidy: Use this for financial, physical, and mental well-being
• $1500 USD annual Learning & Development allowance: To support your career development, all team members will be able to expense development opportunities against this allowance
• Annual leave: PTO plus two additional UpGuardian leave days to give you time to recharge your batteries
• 18 weeks paid Parental Leave: Irrespective of parenting role
• Personal Leave Allowance: This includes sick & carer’s leave
• Fully remote working environment: While we have physical offices in Sydney & Hobart, we do not mandate compulsory attendance
• Top-spec hardware: All team members will be provided with top-spec laptops for their role
• Generative AI subsidy: UpGuard provides paid subscriptions for all team members to access generative AI tools to support their work
• Stock options: Share in UpGuard's growth and long-term success