[All remote jobs](https://jobicy.com/jobs.md)[![UpGuard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/474a12c7-221.png)](https://jobicy.com/company/upguard.md)[UpGuard](https://jobicy.com/company/upguard.md) # Staff Product Security Engineer Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/upguard.md)ShareRemote from[Australia](https://jobicy.com/job-region/australia.md)SalaryUndisclosedDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceDirectorPublished12 Oct 2026Apply before11 Nov 2026Listing views52Application actions2Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. AI Summary ## The role, at a glance. UpGuard is hiring its first dedicated Staff Product Security Engineer to establish and scale the product-security function. The individual contributor will lead threat modeling, security reviews, vulnerability management, detection and response, and secure-by-default cloud and Kubernetes practices. The role partners closely with engineering and platform teams to embed automated, policy-as-code security controls throughout the SDLC and CI/CD pipelines. Strong hands-on experience in cloud security, Kubernetes, IAM, IaC, application security, and practical risk prioritization is central to success. This is a high-ownership remote role supporting an Australia-based location footprint. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThis is a staff-level founding security role with responsibility for setting the product-security roadmap while also delivering technical controls and incident capabilities. It requires broad depth across application, cloud, infrastructure, and operational security, plus the influence to drive remediation across engineering teams. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job medianMarket rate$210,000US market range$175k–$260k0$286k AI insightNo base salary or compensation range is disclosed; the only stated USD amount is a $1,500 annual learning and development allowance, which is a benefit rather than salary. For the US market, estimated annual base pay for a Staff Product Security Engineer with founding-function ownership is approximately $175,000–$260,000 USD, with a midpoint estimate of $210,000 USD. Actual compensation may vary by location, equity, and scope of security leadership. ## Core skills Skills and capabilities most closely associated with this opportunity. [Product security](https://jobicy.com/jobs?search_keywords=Product%20security.md)[Application security](https://jobicy.com/jobs?search_keywords=Application%20security.md)[Threat modeling](https://jobicy.com/jobs?search_keywords=Threat%20modeling.md)[Cloud security](https://jobicy.com/jobs?search_keywords=Cloud%20security.md)[Google Cloud Platform](https://jobicy.com/jobs?search_keywords=Google%20Cloud%20Platform.md)[Kubernetes security](https://jobicy.com/jobs?search_keywords=Kubernetes%20security.md)[Infrastructure as code](https://jobicy.com/jobs?search_keywords=Infrastructure%20as%20code.md)[Terraform](https://jobicy.com/jobs?search_keywords=Terraform.md)[Vulnerability management](https://jobicy.com/jobs?search_keywords=Vulnerability%20management.md)[Security incident response](https://jobicy.com/jobs?search_keywords=Security%20incident%20response.md) Sample interview questionsHow would you establish a product-security program during your first six months as UpGuard's first dedicated product security engineer?I would begin with asset and architecture discovery, stakeholder interviews, and a risk-based baseline across applications, cloud infrastructure, CI/CD, identities, and dependencies. I would then introduce lightweight threat-modeling and security-review workflows for high-risk changes, prioritize critical cloud and Kubernetes guardrails, and establish vulnerability ownership and remediation SLAs. My goal would be to deliver early controls that reduce material risk while creating a roadmap that engineering teams can sustainably adopt. Describe how you would make threat modeling effective for fast-moving engineering teams. I would make threat modeling proportional to risk rather than a heavyweight gate for every change. For major features and architecture changes, I would facilitate concise sessions that identify assets, trust boundaries, abuse cases, and mitigations, then translate findings into owned engineering work. Reusable templates, architecture patterns, and automated checks would allow teams to apply common controls without repeatedly starting from zero. How would you harden a GCP and Kubernetes environment using infrastructure as code? I would define secure baseline modules and policy-as-code controls for IAM least privilege, workload identity, network segmentation, secrets management, encryption, logging, and image provenance. In Kubernetes, I would enforce admission policies, restricted workload settings, RBAC boundaries, network policies, image scanning, and runtime visibility. These controls should run in pull requests and deployment pipelines, with clear exception processes and remediation guidance for developers. How do you prioritize vulnerabilities when a large number of findings compete for attention? I prioritize based on exploitability and business impact rather than severity alone. I combine asset criticality, internet exposure, reachable attack paths, privilege level, availability of exploits, compensating controls, and evidence of active exploitation. I then assign clear owners and deadlines, help teams remediate the highest-risk issues, and add preventive controls when recurring classes of vulnerabilities emerge. Where can AI provide value in an application-security program, and what safeguards would you apply? AI can accelerate code-review assistance, alert triage, vulnerability enrichment, control coverage analysis, and security knowledge retrieval. I would treat its output as advisory, validate high-impact findings with deterministic controls and human review, and avoid exposing sensitive source code or customer data without approved safeguards. I would also assess model access, prompt-injection risks, data retention, and authorization boundaries before integrating AI tools into security workflows. Opportunity details ## About this role. ### Who are we? At UpGuard, we are replacing manual security bottlenecks with AI-driven precision. Fresh off a US$75M Series C, we are scaling our infrastructure to process 100 billion risk signals daily. This isn’t just growth; it’s a total reimagining of how the world manages cyber risk. We build the Cyber Risk Posture Management (CRPM) platform that security teams actually love. By integrating security ratings, threat intel, and agentic AI, we empower organisations to stay ahead of an ever evolving attack surface. We aren’t just building another tool; we’re defining a category. We provide the autonomy to ship world-class technology and the resources to do it at a global scale. ### About the role This is UpGuard’s first dedicated product security hire. You’ll have significant ownership over the direction of product security at UpGuard as we scale. You won’t be inheriting someone else’s decisions. You’ll be defining the security standards, tooling, and practices that protect UpGuard’s products and infrastructure for years to come. In this role, you’ll work across our product and production environments: performing security reviews, managing vulnerabilities, and running detection and response operations in our cloud-native infrastructure. You’ll collaborate closely with our product engineering and platform teams to secure our products, CI/CD pipelines, and production systems, and to embed security into how we build from the ground up. The full remit of product security is broad, so we’ve been deliberate about sequencing. In your first 6–12 months you’ll: * Refresh threat modelling and security review as a standard part of how we ship. * Figure out where AI actually helps in AppSec (code review, triage, coverage) and build what works * Harden our GCP and Kubernetes baseline and get secure-by-default configs into infrastructure-as-code The function sits at the heart of our engineering organisation, and you’ll have genuine autonomy and influence: defining the security roadmap, driving best practices, and scaling our security posture as we grow. This is a Staff-level individual contributor role. ### What you’ll do * Lead threat modelling and security reviews across UpGuard’s product portfolio and cloud infrastructure, proactively surfacing attack vectors and designing mitigation strategies that scale with growth. * Build automation, policy-as-code, and AI-driven security tooling that lets product engineering teams “shift left” and embeds security across the SDLC, leveraging agentic workflows to triage, review, and scale the reach of a lean security function. * Design and implement secure-by-default configurations for cloud and Kubernetes infrastructure. * Own vulnerability management end-to-end, triaging and prioritizing by real risk, driving remediation with engineering teams, and building preventative controls across the software supply chain from development through production. * Build scalable detection and response systems that catch malicious activity, triage the noise, and run incidents end to end. * Build deep partnerships with our product engineering and platform teams, helping them deliver secure-by-design solutions. You’ll be building a function, not inheriting one; with real executive backing, at a company where product security is core to the business rather than a cost centre. Our engineering culture values iteration, collaboration, and speed, with a no-ego approach and pragmatic trade-offs. We’re fully remote with optional offices in Sydney and Hobart, and no mandatory office attendance. ### What you’ll bring * 7+ years of experience in security engineering and/or software engineering/or security operations, work in cloud environments, with a focus on the below: * Cloud security experience (GCP preferred, but AWS or Azure is welcome) * Cloud native Kubernetes services (EKS/GKE/AKS) and strong container security principles * Strong understanding of securing IAM and cloud identities * Experience leading technical security reviews of products and architectures, running threat modelling exercises, and turning findings into security controls engineering teams can implement. * Strong knowledge of common web application vulnerabilities and how to prevent them (OWASP Top 10 and similar). * Hands-on experience with IAC and related tools (preferably Terraform/OpenTofu) ### What will give you an edge? * Experience as the first security hire or founding member of a security function at a scaling company. * Familiarity with AI/LLM security risks (e.g. OWASP LLM Top 10) and securing AI-powered product features. * Strong backend engineering skills, particularly in Go * Experience supporting SOC 2 / ISO 27001 audits from an engineering perspective. * Public security research, CVEs, open-source security tooling, or conference talks. * Offensive security skills, with the ability to validate findings through hands-on exploitation. ### What’s in it for you? * WFH set-up allowance: To ensure you have the right environment to work in, we will help you get set up within your first 3 months at UpGuard * Monthly Lifestyle subsidy: Use this for financial, physical, and mental well-being * $1500 USD annual Learning & Development allowance: To support your career development, all team members will be able to expense development opportunities against this allowance * Annual leave: PTO plus two additional UpGuardian leave days to give you time to recharge your batteries. * 18 weeks paid Parental Leave: Irrespective of parenting role * Personal Leave Allowance: This includes sick & carer’s leave * Fully remote working environment: While we have physical offices in Sydney & Hobart, we do not mandate compulsory attendance * Top-spec hardware: All team members will be provided with top-spec laptops for their role * Generative AI subsidy: UpGuard provides paid subscriptions for all team members to access generative AI tools to support their work. * Stock options: Share in UpGuard’s growth and long-term success UpGuard is a Certified Great Place to Work® in the US, Australia, UK and India, establishing its position as a leading global technology employer. 99% of team members agree that UpGuard is a great place to work! Apply now to find out why! As an Equal Employment Opportunity and Affirmative Action Employer, qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender perception or identity, national origin, age, marital status, protected veteran status, or disability status. Please Note: Not all roles can be performed from the United States. Please check your specific job listing to confirm its advertised location. If the role you are applying for is listed as based in the US, we are currently only able to support hiring in the following locations: CA, CO, FL, IL, MA, MD, MO, OR, PA, TX, WA, and DC. Before starting work with us, you will need to undertake a national police history check and reference checks. Show more [Apply now >](https://jobicy.com/jobs/155088-staff-product-security-engineer-2.md) > Annual salary information is not provided for this position. Explore salary ranges for similar roles in our [Salary Directory ›](https://jobicy.com/salaries.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Cision logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/e9661342-221.jpeg) Cision Oct 12 New ### [Senior Security Engineer](https://jobicy.com/jobs/155075-senior-security-engineer.md) At Cision, we believe in empowering every individual to make an impact. Here, your voice is heard, your ideas are valued, and your unique perspective fuels our collective success. As… * ![Five9 logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/7c3d754e-221.png) Five9 Oct 12 New ### [Staff Information Security Engineer](https://jobicy.com/jobs/155070-staff-information-security-engineer.md) Join us in bringing joy to customer experience. Five9 is a leading provider of cloud contact center software, bringing the power of cloud innovation to customers worldwide. Living our values… * ![Stripe logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/WRILS-201011073943-272457.png) Stripe Oct 12 New ### [Abuse Research Engineer](https://jobicy.com/jobs/153053-abuse-research-engineer.md) Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Oct 11 New ### [Senior / Staff Intelligence Analyst, Environmental Crimes](https://jobicy.com/jobs/155032-senior-staff-intelligence-analyst-environmental-crimes.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![Databricks logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/12/4e3f864ba9cf3c62d471e1c62414d098.jpg) Databricks Oct 11 New ### [Staff Security Engineer, Incident Response](https://jobicy.com/jobs/155021-staff-security-engineer-incident-response.md) RDQ327R180 Staff Security Engineer, Incident Response The Incident Response team’s mission is to respond to security threats, incidents and investigations to protect our customers, employees and enterprise data in a… * ![Resilience logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e67f0de9-221.png) Resilience Oct 11 New ### [Tabletop Exercise (TTX) Specialist – Cybersecurity Focus](https://jobicy.com/jobs/154999-tabletop-exercise-ttx-specialist-cybersecurity-focus.md) About Us At Resilience, we’re creating a new category that integrates cybersecurity, cyber insurance, and cyber risk management. Founded in 2016 by experts from across the highest tiers of the… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Oct 11 New ### [Blockchain Security Expert – Chain Security Evaluation Track](https://jobicy.com/jobs/152970-blockchain-security-expert-chain-security-evaluation-track.md) About You You’re a self-starter who thrives on tackling the toughest and most meaningful problems, even if they are the most difficult problems. You’re comfortable with the unknown and understand… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Oct 11 New ### [Blockchain Security Expert Intern – AI Track](https://jobicy.com/jobs/152979-blockchain-security-expert-intern-ai-track.md) About the Company Founded in 2018 by professors of Yale University and Columbia University, CertiK is a pioneer in blockchain security, utilizing best-in-class AI technology to secure and monitor blockchain… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Oct 11 New ### [Blockchain Security Expert – Security Audit Track](https://jobicy.com/jobs/152975-blockchain-security-expert-security-audit-track.md) About You You’re a self-starter. You believe in tackling the most important problems, even if they are the most difficult problems. You’re comfortable with the unknown and understand that #startuplife… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Oct 11 New ### [Blockchain Security Expert – Anti Defect Track](https://jobicy.com/jobs/152966-blockchain-security-expert-anti-defect-track.md) About the Company Founded in 2018 by professors of Yale University and Columbia University, CertiK is a pioneer in blockchain security, utilizing best-in-class AI technology to secure and monitor blockchain… [Browse all jobs](https://jobicy.com/jobs.md)