Staff Product Security Engineer

About UpGuard

UpGuard is revolutionizing the management of cyber risk by replacing manual security processes with AI-driven precision. Following a recent US$75M Series C funding, the company is scaling to handle 100 billion risk signals daily. Their Cyber Risk Posture Management platform combines security ratings, threat intelligence, and intelligent AI for proactive security across evolving cyber landscapes.

Role Overview

This pioneering role as UpGuard's inaugural dedicated product security engineer offers significant ownership in shaping product security standards, tooling, and practices for the company's products and infrastructure. The position involves security reviews, vulnerability management, and incident detection in a cloud-native environment. Close collaboration with product engineering and platform teams is essential to embed security throughout development and operations.

Key Responsibilities

• Lead threat modeling and security assessments of products and cloud infrastructure, proactively identifying risks and designing scalable mitigation strategies.
• Develop automation, policy-as-code, and AI-driven security tools to integrate security early in the software development lifecycle, employing intelligent workflows to optimize lean security operations.
• Implement secure-by-default configurations for cloud and Kubernetes infrastructures.
• Manage vulnerability processes end-to-end, prioritizing based on actual risk, facilitating remediation, and establishing preventive controls across the software supply chain.
• Create scalable detection and response frameworks to identify and handle malicious activities effectively.
• Foster strong partnerships with product engineering and platform teams to implement secure-by-design solutions.

Initial Focus (First 6–12 Months)

• Revise and standardize threat modeling and security review processes as integral to product delivery.
• Identify impactful AI applications in application security like code review and issue triage, and develop effective solutions.
• Strengthen GCP and Kubernetes baselines with secure configurations embedded in infrastructure-as-code.

Required Experience and Skills

• Minimum 7 years in security engineering, software engineering, or security operations with cloud environments.
• Expertise in cloud security, preferably Google Cloud Platform (GCP); familiarity with AWS or Azure is also valued.
• Proficiency with cloud-native Kubernetes services (EKS, GKE, AKS) and container security principles.
• Strong grasp of securing identity and access management (IAM) and cloud identities.
• Experience conducting technical security reviews, leading threat modeling exercises, and translating findings into actionable security controls.
• Deep understanding of web application vulnerabilities (e.g., OWASP Top 10) and their mitigation strategies.
• Hands-on experience with Infrastructure as Code tools, preferably Terraform or OpenTofu.

Preferred Qualifications

• Experience as the first security hire or in establishing security functions in growing companies.
• Awareness of AI/LLM security challenges, including OWASP LLM Top 10, securing AI-enabled features.
• Strong backend development skills, especially in the Go programming language.
• Familiarity with SOC 2 and ISO 27001 audit processes from an engineering standpoint.
• Contributions to security research, CVEs, open-source tooling, or security conferences.
• Offensive security capabilities with proficiency in verifying vulnerabilities via exploitation.

Benefits and Perks

• Work-from-home setup allowance provided within the first three months.
• Monthly lifestyle subsidy to support financial, physical, and mental well-being.
• Annual learning and development budget of $1500 USD.
• Generous paid time off including standard PTO plus two additional company leave days.
• 18 weeks of paid parental leave regardless of parenting role.
• Personal leave encompassing sick and carer's leave.
• Flexible fully remote working model with optional office presence in Sydney and Hobart; no mandatory attendance.
• Provision of high-spec laptops for work.
• Subscription access to generative AI tools to aid work tasks.
• Opportunity to receive stock options to share in company growth.

Diversity and Hiring Process

UpGuard is recognized as a Certified Great Place to Work® across multiple countries and is committed to equal employment opportunities regardless of background or identity. Employment is subject to national police checks and reference verification. Note that certain roles, including this one based in Tasmania, may have location-specific hiring constraints.