[All remote jobs](https://jobicy.com/jobs.md)[![Filigran logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/7b905d81717f-221.webp)](https://jobicy.com/company/filigran.md)[Filigran](https://jobicy.com/company/filigran.md) # Staff AppSec / Product Security Engineer AI Summary Filigran is hiring a Staff AppSec / Product Security Engineer to embed product security across its open-source and enterprise XTM platform. The role advises the CISO, leads operational product-security practices, and partners closely with R&D, platform, compliance, customer success, and the security-research community. Core work includes threat modeling, secure code reviews, shared secure-by-default components, CI supply-chain controls, vulnerability management, and coordinated disclosure. The successful candidate combines deep hands-on engineering ability with cross-team influence, mentorship, and expertise in SaaS, API, cloud-native, and AI security. This is a remote, async-first full-time role based in France.[Apply for this job](#job-application)[View company](https://jobicy.com/company/filigran.md)ShareRemote from[France](https://jobicy.com/job-region/france.md)SalaryUndisclosedDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceDirectorPublished11 Nov 2026Apply before11 Dec 2026Listing views27Application actions1Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. ### 🌀 The Company Founded in 2022, [Filigran](https://jobicy.com/company/filigran.md) is a global cybersecurity company on a mission to empower defense teams to be proactive through open-source solutions that uncover threats and drive action. Filigran stands out in the cybersecurity ecosystem through its open-source, AI-powered and threat-informed approach to Continuous Threat Exposure Management (CTEM). Our eXtended Threat Management (XTM) platform brings together threat intelligence, exposure validation and cyber risk reduction, enabling organizations to better understand their threat landscape and take action. At the heart of Filigran is our open-source approach. Our vision is to unite defenders into a global community to make security more open, resilient and collaborative. As Filigran continues to scale globally, we are building the organization, infrastructure and capabilities needed for our next stage of growth. How we scale matters just as much as how fast we scale: our CORE values: Cohesion, Openness, Responsibility and Equity shape how we work together, make decisions and build for the future. ### 🎯 The Role We’re looking for a Staff AppSec / Product Security Engineer to join our Digital Security team, and make security a built-in quality of everything we ship across the XTM platform (OpenCTI, OpenAEV, XTM One, XTM Hub). You’ll work closely with the R&D team: the VP, Staff and Principal Engineers, Engineering Managers, Product Owners and the Product Manager. You’ll help keep our open source and enterprise products trustworthy for the 6,000+ organizations that defend themselves with them. This is not a solo audit role. As a Staff engineer, you advise the CISO on product security and turn their strategy into day-to-day practice in the product teams. You lead security as a cross-cutting concern, and coach engineers so they own security in their own scope. And of course, you still code: critical security fixes, PR reviews, pair programming and the shared security components that make the secure path the easy one. ### 💼 Your Responsibilities * Leverage AI tools and methodologies to boost productivity and impact * Contribute to building AI capabilities into internal workflows * Advise the CISO on product security strategy across the XTM platform, and lead its operational implementation in the product teams: turn priorities into concrete actions, and track security technical pains to resolution. * Lead threat modeling and security reviews in feature refinements with Product Owners: authentication and RBAC, multi-tenancy, connectors, the GraphQL API, and AI and agent features. * Ensure the security quality of the stack through critical PRs, fixes and code reviews, and build shared, secure-by-default components (authorization, secrets, safe outbound calls, input handling). * Drive secure SDLC and supply chain tooling in CI (SAST, SCA, secret and container scanning, Renovate, Snyk, SBOMs, signed releases), tuned so teams trust the results. * Run product vulnerability management: intake from the open source community, researchers and bug bounty, coordinated disclosure, CVEs and advisories, remediation SLAs, and the product side of security incidents. * Mentor engineers and grow security champions through pairing, workshops and continuous feedback. Document security architecture decisions so they stay consistent across teams. ### 🤝 Who You’ll Work With * Reports to: the CISO, as part of the Digital Security team. * Key collaborators: the R&D team, including Staff and Principal Engineers and Engineering Managers across the product teams, and Product Owners during refinements, Platform Engineering on infrastructure, compliance (SOC 2 Type 2, ISO 27001:2022, FedRamp) and incidents, and Customer Success on customer security questions and pentest findings. * Community: the OpenCTI and OpenAEV open source contributors and the security researchers who report vulnerabilities to us. * Mentorship: no direct reports. You’ll act as the security technical reference and mentor for engineers across all teams, and grow a network of security champions. ### 🧬 Profile We’re Looking For * Strong interest in AI and its applications in cybersecurity * Comfortable working with and leveraging AI-powered tools (LLMs, automation, copilots, etc.) to improve workflows and productivity * Master degreee in computer science and or cybersecurity with 8+ years of experience in software engineering and application or product security, including at least 3 years as the security technical reference for a SaaS or enterprise product * Comfortable working in a remote, async-first environment * Strong engineering and security skills: you write production code fluently in at least two of Python, Node.js, TypeScript, Java or Rust, and you know web and API security in depth (GraphQL, OIDC/SAML, RBAC, multi-tenant isolation, SSRF, injection), CI/CD security tooling, and container and Kubernetes security * A track record of influence without authority: you led a cross-team security initiative, coached engineers, and got standards adopted with pragmatism and clear priorities * Autonomy, ownership, and team spirit * Bonus: AI and LLM security (prompt injection, agent permissions), open source contributions or published CVEs, bug bounty program experience, knowledge of STIX 2.1 / MITRE ATT&CK or hands-on use of OpenCTI or OpenAEV ### 🌱 Why Join Filigran? More than just a job. We are a fast-growing, global and remote-first company, and we believe the best work combines purpose, impact and innovation. You’ll work alongside talented people across the world who care about what they build, how they build it, and the impact they make on the broader cybersecurity ecosystem. ⭐ Be part of something bigger We believe we do work that matters. Our open-source approach means that work extends beyond Filigran. You’re contributing to technology and ideas that strengthen a global community of defenders and help make cybersecurity more open and collaborative. 💻 Work at the edge of what’s next We bring together cybersecurity, open source and AI — giving you the opportunity to work with emerging technologies, experiment with new ways of working, and contribute to how they are applied in practice. 🌍 Global opportunity without borders Be part of a fast-growing, truly international team — collaborating across Europe, North America, APJ and beyond, with the flexibility of a remote-first environment. As we grow, you’ll have opportunities to expand your scope, take ownership, learn quickly and grow with us. 🧭 A culture grounded in CORE Cohesion, Openness, Responsibility and Equity define how we work together — with openness, ownership, collaboration and respect. These are the principles that guide how we make decisions, treat people and grow together, especially when no one’s watching. ### 💰 What you can expect * Competitive compensation + equity — everyone shares in our success * Remote-first flexibility — work from wherever you’re based, with flexibility built into how we operate * 25 days PTO baseline — real time to disconnect, recharge and enjoy life outside work * Volunteer days — paid time to contribute to causes that matter to you * Set up for success — choose the equipment that works for you, with additional support for your remote work and development needs as our programs evolve * Two annual in-person get-togethers — one global company get-together and one team get-together, creating dedicated time to connect, collaborate and strengthen our culture beyond the screen ### 🌍 Equal Employment Opportunity We enable cybersecurity through inclusion — from code to culture. At Filigran, we are proud to be an equal opportunity employer. We believe the diversity of our people makes our products and our team stronger. We welcome talent of every background, identity and lived experience, regardless of race, color, religion, gender, gender identity or expression, sexual orientation, national origin, age, disability or veteran status. What matters here is what you bring, not what you look like, where you’re from or how you identify. ### 🚀 Ready to Join Us? Apply now and help us build the future of the cybersecurity ecosystem, together. Show more [Apply now >](https://jobicy.com/jobs/161366-staff-appsec-product-security-engineer.md) > Annual salary information is not provided for this position. Explore salary ranges for similar roles in our [Salary Directory ›](https://jobicy.com/salaries.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThis is a senior staff-level security role requiring broad technical depth, strategic judgment, and influence across multiple engineering teams. The engineer must remain hands-on while owning cross-cutting security outcomes in a fast-growing product environment. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$150,000US market range (per year)$125k–$180k0$198.00k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. No employer salary was disclosed. The displayed figures are estimated annual USD market compensation for a Staff Application/Product Security Engineer and are not employer-provided amounts. ## Core skills Skills and capabilities most closely associated with this opportunity. [Application security](https://jobicy.com/jobs?search_keywords=Application%20security.md)[Product security](https://jobicy.com/jobs?search_keywords=Product%20security.md)[Threat modeling](https://jobicy.com/jobs?search_keywords=Threat%20modeling.md)[Secure SDLC](https://jobicy.com/jobs?search_keywords=Secure%20SDLC.md)[Secure code review](https://jobicy.com/jobs?search_keywords=Secure%20code%20review.md)[GraphQL security](https://jobicy.com/jobs?search_keywords=GraphQL%20security.md)[OIDC and SAML](https://jobicy.com/jobs?search_keywords=OIDC%20and%20SAML.md)[Role-based access control](https://jobicy.com/jobs?search_keywords=Role-based%20access%20control.md)[Multi-tenant security](https://jobicy.com/jobs?search_keywords=Multi-tenant%20security.md)[CI/CD security](https://jobicy.com/jobs?search_keywords=CICD%20security.md)[Software supply chain security](https://jobicy.com/jobs?search_keywords=Software%20supply%20chain%20security.md)[Kubernetes security](https://jobicy.com/jobs?search_keywords=Kubernetes%20security.md)[Vulnerability management](https://jobicy.com/jobs?search_keywords=Vulnerability%20management.md)[Python](https://jobicy.com/jobs?search_keywords=Python.md)[TypeScript](https://jobicy.com/jobs?search_keywords=TypeScript.md) Sample interview questionsHow would you introduce threat modeling into product feature refinement without slowing delivery excessively?I would make threat modeling lightweight, repeatable, and integrated into existing refinement ceremonies. I would use focused prompts covering data flows, trust boundaries, authorization, tenant isolation, abuse cases, and third-party dependencies, then translate identified risks into prioritized engineering actions and acceptance criteria. Describe your approach to securing a multi-tenant GraphQL API. I would enforce authorization at resolver and data-access layers, not rely on client-side controls, and validate tenant context on every request. I would also apply query depth and complexity limits, input validation, rate limiting, audit logging, secure error handling, and automated tests for horizontal and vertical privilege escalation. How do you tune SAST, SCA, secret scanning, and container scanning so engineers trust the results? I begin with a risk-based baseline and integrate tools into developer workflows with clear ownership and remediation paths. I reduce false positives through rule tuning and triage, define severity-based SLAs, measure signal quality, and periodically review coverage so teams see actionable findings rather than alert fatigue. How would you manage a vulnerability reported by an open-source contributor or external researcher? I would acknowledge the report quickly, validate severity and affected versions, establish a confidential communication channel, and coordinate remediation with product and engineering owners. I would track the fix through release, prepare an advisory and CVE where appropriate, notify affected users responsibly, and conduct a retrospective to improve prevention and response. What security risks do AI and agent features introduce, and how would you mitigate them? Key risks include prompt injection, unsafe tool use, data leakage, excessive agent permissions, insecure model integrations, and untrusted output handling. I would use least-privilege tool permissions, strict authorization checks outside the model, input and output controls, isolated execution where needed, logging, human approval for high-impact actions, and adversarial testing. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Chainguard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e4b6aacf-221.jpeg) Chainguard Nov 11 New ### [Security Analyst, Governance and Trust](https://jobicy.com/jobs/161420-security-analyst-governance-and-trust-2.md) Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations… * ![Deepgram logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/12/WRILS-201212160008-406229.jpg) Deepgram Nov 11 New ### [Security Engineer](https://jobicy.com/jobs/161394-security-engineer-6.md) Company Overview Deepgram is bringing the world’s most natural interface, voice, to the technology we use every day. Our speech models and real-time infrastructure power AI systems that keep up… * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Nov 11 New ### [Manager, Security Operations Center](https://jobicy.com/jobs/161297-manager-security-operations-center-2.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Nov 11 New ### [Blockchain Intelligence Analyst, Transnational Crime Organizations](https://jobicy.com/jobs/161263-blockchain-intelligence-analyst-transnational-crime-organizations.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![ŌURA logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/07/011c99434cd6-221.webp) ŌURA Nov 11 New ### [AI Security Engineer, Detection and Response](https://jobicy.com/jobs/161250-ai-security-engineer-detection-and-response.md) Our mission at ŌURA is to empower every person to own their inner potential. Our award-winning products help our global community gain a deeper knowledge of their readiness, activity, and… * ![EverAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91735b0b-221.png) EverAI Nov 11 New ### [Security Engineer (Remote – Denmark)](https://jobicy.com/jobs/161233-security-engineer-remote-denmark.md) Our Vision & Products 🚀 EverAI — Building the Future of AI Companionship One of the Top 15 Largest & Fastest-Growing AI Companies in the World 50 Million Users in… * ![EverAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91735b0b-221.png) EverAI Nov 11 New ### [Security Engineer (Remote – Croatia)](https://jobicy.com/jobs/161231-security-engineer-remote-croatia.md) Our Vision & Products 🚀 EverAI — Building the Future of AI Companionship One of the Top 15 Largest & Fastest-Growing AI Companies in the World 50 Million Users in… * ![EverAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91735b0b-221.png) EverAI Nov 11 New ### [Security Engineer (Remote – Hungary)](https://jobicy.com/jobs/161229-security-engineer-remote-hungary.md) Our Vision & Products 🚀 EverAI — Building the Future of AI Companionship One of the Top 15 Largest & Fastest-Growing AI Companies in the World 50 Million Users in… * ![EverAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91735b0b-221.png) EverAI Nov 11 New ### [Security Engineer (Remote – Spain)](https://jobicy.com/jobs/161227-security-engineer-remote-spain.md) Our Vision & Products 🚀 EverAI — Building the Future of AI Companionship One of the Top 15 Largest & Fastest-Growing AI Companies in the World 50 Million Users in… * ![EverAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91735b0b-221.png) EverAI Nov 11 New ### [Security Engineer (Remote – Netherlands)](https://jobicy.com/jobs/161225-security-engineer-remote-netherlands.md) Our Vision & Products 🚀 EverAI — Building the Future of AI Companionship One of the Top 15 Largest & Fastest-Growing AI Companies in the World 50 Million Users in… [Browse all jobs](https://jobicy.com/jobs.md)