Product Security Engineer

The Security team at WorkOS is responsible for keeping the data and identities of hundreds of millions of users secure. Security is fundamental to our products, and customer trust is the foundation of our success. We are a highly collaborative group with a strong engineering mindset. Our security program is shaped by hands-on experience attacking and defending systems, and applying lessons from across the industry. We are comfortable in code and collaborate often with engineering to create products that are secure by default.

Responsibilities

Lead secure design efforts; Partner with engineering teams on secure design and code reviews; Identify and prioritize risks early in the product lifecycle; Build secure by default systems; Develop paved paths that systemically reduce risk; Perform offensive security testing; Conduct penetration tests and code audits on new and existing products; Improve our security tooling; Integrate and improve static analysis, supply chain security, and vulnerability management capabilities across engineering pipelines; Operate our responsible disclosure program; Run and improve the program by furthering automation, validating submissions, and coordinating remediation; Improve our products; Write and ship code to remediate vulnerabilities in production systems; Work directly with customers; Help build customers' trust by directly engaging with their security-related questions and concerns

Requirements

5+ years of experience in a security engineering or security-focused software engineering role; Ability to execute across a wide range of security functions such as security assessments, penetration testing, responsible disclosure, security tooling integration, etc.; Familiarity with and experience using common industry tooling; Proven ability to identify vulnerabilities in software, demonstrated through CVEs, bug bounty, blog posts, or prior work experience; Strong written and verbal communication skills, particularly in partnering with engineering teams; Comfortable reading and writing code, and able to effectively leverage AI during the process; Risk-focused and pragmatic; A builder who can break things, comfortable reading and writing code; A strong partner to engineering; Excited about AI; Curious and humble

Nice to have

Experience in the authentication and identity domain; Experience writing production level code, especially developing security features

Benefits

401k matching; Competitive Equity; Healthcare, dental and vision coverage; FSA, ST/LT Disability, Voluntary Life; Carrot fertility benefits; 20 days paid vacation + 10 holidays + unlimited sick leave; 12 weeks fully paid parental leave; Fitness monthly stipend; Wellness monthly stipend; Commuter benefits for hybrid employees in SF/NYC; Unlimited token usage; Parental leave, paid-time off and fully remote working arrangements