Senior Product Security Engineer

Senior Product Security Engineer

Your role and responsibilities

The Secure Lifecycle Management (SLM) organization is seeking a Product Security Engineer to partner closely with the engineering teams responsible for HashiCorp Vault, Boundary, and Radar. This role is embedded directly within the engineering organization and serves as a trusted security advisor throughout the Product Development Lifecycle (PDLC), helping teams build secure-by-design products, proactively identify risks, and respond effectively to security vulnerabilities and incidents.

The ideal candidate combines deep application and product security expertise with strong software engineering skills and the ability to collaborate across Product Management, Engineering, Product Security, and Security Operations teams.

Roles and Responsibilities

• Partner directly with Vault, Boundary, and Radar engineering teams to embed security throughout the PDLC and improve the security posture of new and existing capabilities.

• Serve as the security SME for Vault, Radar, Boundary and work closely with central Product Security, and Security Operations teams on coordinated vulnerability disclosure, security advisories, and customer-facing security communications.

• Conduct architecture reviews, design reviews, threat modeling, and security assessments for new products, features, and platform initiatives.

• Provide actionable guidance to engineering teams on secure design patterns, defensive architectures, security controls, and remediation strategies.

• Help establish and promote secure-by-design engineering practices, security standards, and product-specific security best practices.

• Assess internally discovered and externally reported security vulnerabilities, including validation, exploitability analysis, risk assessment, severity determination, and remediation prioritization.

• Collaborate with engineering teams to identify workarounds, develop fixes, review remediation plans, and validate security improvements.

• Participate in security incident response activities, including investigation, impact assessment, containment planning, root cause analysis, and post-incident improvements.

• Assist in building and prototyping AI-assisted security tooling, workflows, and skills that improve the scale and efficiency of vulnerability triage, assessment, remediation, and security review activities.

• Contribute to automation and process improvements that reduce security response time and improve engineering productivity.

• Required education

• High School Diploma/GED

• Preferred education

• Bachelor's Degree

• Required technical and professional expertise

• 5+ years of experience in application security, product security, or security engineering, with 8+ years of overall industry experience preferred.

• Secure Design & Risk Assessment: Expertise in threat modeling, architecture reviews, security design reviews, and vulnerability assessments.

• Vulnerability Management: Experience identifying, triaging, prioritizing, and assessing security vulnerabilities based on exploitability and business impact.

• Application Security Expertise: Strong knowledge of OWASP Top 10, CWE, CVSS, modern vulnerability management practices, and secure software development principles.

• Technical & Security Foundations: Proficiency in Go, Python, or Rust, with deep understanding of authentication, authorization, encryption, PKI, key management, identity, and secrets management, along with a proven ability to influence teams and drive secure engineering practices.

• Preferred technical and professional experience

• Application & Cloud Security: Hands-on experience with static and dynamic analysis, software composition analysis (SCA), container security, cloud security tools, and vulnerability research.

• Security Operations & Communication: Experience with incident response, coordinated vulnerability disclosure, security advisories, and customer-facing security communications.

• Security Engineering & Automation: Familiarity with HashiCorp technologies, including Vault, Boundary, Consul, Terraform, and Radar, along with experience building security automation, developer security tools, or AI-assisted security workflows.

• Education: Bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or equivalent practical experience.

• ABOUT BUSINESS UNIT

• IBM Software infuses core business operations with intelligence—from machine learning to generative AI—to help make organizations more responsive, productive, and resilient. IBM Software helps clients put AI into action now to create real value with trust, speed, and confidence across digital labor, IT automation, application modernization, security, and sustainability. Critical to this is the ability to make use of all data, because AI is only as good as the data that fuels it. In most organizations data is spread across multiple clouds, on premises, in private datacenters, and at the edge. IBM’s AI and data platform scales and accelerates the impact of AI with trusted data, and provides leading capabilities to train, tune and deploy AI across business. IBM’s hybrid cloud platform is one of the most comprehensive and consistent approach to development, security, and operations across hybrid environments—a flexible foundation for leveraging data, wherever it resides, to extend AI deep into a business.

• YOUR LIFE @ IBM

• In a world where technology never stands still, we understand that, dedication to our clients success, innovation that matters, and trust and personal responsibility in all our relationships, lives in what we do as IBMers as we strive to be the catalyst that makes the world work better.

• Being an IBMer means you’ll be able to learn and develop yourself and your career, you’ll be encouraged to be courageous and experiment everyday, all whilst having continuous trust and support in an environment where everyone can thrive whatever their personal or professional background.

• Our IBMers are growth minded, always staying curious, open to feedback and learning new information and skills to constantly transform themselves and our company. They are trusted to provide on-going feedback to help other IBMers grow, as well as collaborate with colleagues keeping in mind a team focused approach to include different perspectives to drive exceptional outcomes for our customers. The courage our IBMers have to make critical decisions everyday is essential to IBM becoming the catalyst for progress, always embracing challenges with resources they have to hand, a can-do attitude and always striving for an outcome focused approach within everything that they do.

• Are you ready to be an IBMer?

• ABOUT IBM

• IBM’s greatest invention is the IBMer. We believe that through the application of intelligence, reason and science, we can improve business, society and the human condition, bringing the power of an open hybrid cloud and AI strategy to life for our clients and partners around the world.

• Restlessly reinventing since 1911, we are not only one of the largest corporate organizations in the world, we’re also one of the biggest technology and consulting employers, with many of the Fortune 500 companies relying on the IBM Cloud to run their business.

• At IBM, we pride ourselves on being an early adopter of artificial intelligence, quantum computing and blockchain. Now it’s time for you to join us on our journey to being a responsible technology innovator and a force for good in the world.

• IBM is proud to be an equal-opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender, gender identity or expression, sexual orientation, national origin, genetics, pregnancy, disability, neurodivergence, age, or other characteristics protected by the applicable law. IBM is also committed to com