[Hiring] Staff Product Security Engineer @Guidewire Software

Role Description

We’re looking for a Staff Security Engineer to lead penetration testing across Guidewire’s products. In this role, you’ll shape and run a pen testing program that combines hands-on testing, third-party vendor engagements, and AI-assisted tooling. You’ll ensure every product is tested before release, findings are validated and fixed, and our products meet customer, contractual, and regulatory requirements. You’ll partner closely with product, engineering, and compliance teams, setting the direction for how security testing scales with the business as a Staff Security Engineer. As needed, you’ll also support broader Product Security Incident Response Team (PSIRT) activities, such as vulnerability triage and incident coordination.

Qualifications

• Bachelor's or master's degree in computer science, or equivalent experience.
• 7+ years of application or product security experience, including at least 5 years of hands-on penetration testing of web applications, APIs, and cloud-hosted services.
• Proven experience managing third-party pen testing vendors, including scoping, scheduling and report review.
• Hands-on experience testing applications hosted on AWS, including IAM and multi-tenant architectures.
• Working knowledge of compliance requirements for pen testing, such as SOC 2, ISO 27001, or PCI DSS.
• Solid understanding of the OWASP Top 10, OWASP API Security Top 10, OWASP Top 10 for LLM Applications, and common product vulnerability classes.
• Hands-on experience with pen testing tools such as Burp Suite, along with SAST, DAST and vulnerability scanning tools.
• Experience risk-rating vulnerabilities with CVSS.
• Scripting skills (Python, Shell, or similar) to build testing tools and automation.
• Strong written and verbal communication skills, including the ability to write clear pen test reports for engineers, executives, and customers.
• Proven ability to build relationships and influence people at all levels, as well as vendors and external partners.

Requirements

• Plan and perform penetration tests of Guidewire web applications, APIs, cloud services, and integrations to identify critical vulnerabilities before release and in production.
• Test tenant isolation, cross-tenant data access and authorization boundaries in multi-tenant SaaS environments.
• Lead security testing of AI/ML-powered product features, including LLM applications, APIs, and inference endpoints.
• Identify issues such as prompt injection, data and model leakage, insecure RAG implementations, and abuse vectors.
• Validate, reproduce and risk-rate findings using industry-standard metrics such as CVSS, and give engineering teams clear, actionable remediation guidance.
• Retest fixes and confirm closure before findings are marked resolved.
• Develop pen testing tooling, scripts and automation, and evaluate AI-assisted and autonomous testing tools to scale coverage and repeatability.
• Own the pen testing schedule across the product release lifecycle, ensuring every product is tested prior to key release milestones.
• Decide when and how products need testing based on risk, release scope and compliance requirements.
• Define testing scope, rules of engagement, environments, and access for each vendor engagement.
• Align product teams, implementation partners and vendors on their pen testing responsibilities.
• Manage vendor relationships end-to-end: onboarding, statements of work, kickoff, status tracking, quality reviews of reports, and issue escalation.
• Manage the pen testing budget, including vendor costs, forecasting and utilization.
• Review vendor reports for accuracy and completeness, remove false positives and consolidate findings into the vulnerability management process.
• Ensure pen testing meets compliance obligations for Guidewire products.
• Maintain pen test evidence, attestation letters and executive summaries for auditors and customers.
• Track remediation of pen test findings against SLAs and report status and risk to product, engineering, and security leadership.
• Define and report program metrics such as test coverage, on-time completion, finding age, and SLA compliance.
• Respond to customer security questions about pen testing practices and results.
• Support the broader incident response program as needed.
• Triage internally and externally reported security issues, verify them across product versions, and perform root cause analysis.
• Coordinate with external security researchers, reporting organizations, and customers on reported vulnerabilities.
• Support security releases with engineering and sustaining teams, including security-focused code and design reviews.
• Validate findings from SAST, DAST, SCA and container scanning tools.

Company Description

Guidewire is the platform P&C insurers trust to engage, innovate, and grow efficiently. We combine digital, core, analytics, and AI to deliver our platform as a cloud service. More than 540+ insurers in 40 countries, from new ventures to the largest and most complex in the world, run on Guidewire.

As a partner to our customers, we continually evolve to enable their success. We are proud of our unparalleled implementation track record with 1600+ successful projects, supported by the largest R&D team and partner ecosystem in the industry.

Our Marketplace provides hundreds of applications that accelerate integration, localization, and innovation.