[All remote jobs](https://jobicy.com/jobs.md)[![UpGuard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/474a12c7-221.png)](https://jobicy.com/company/upguard.md)[UpGuard](https://jobicy.com/company/upguard.md) # Staff Security Engineer (Product & Cloud) AI Summary UpGuard is hiring a Staff Security Engineer to establish and scale its product security function across cloud-native products and production infrastructure. The role leads threat modeling, security reviews, vulnerability management, detection and response, and secure-by-default cloud controls. It requires strong hands-on expertise in GCP or comparable cloud platforms, Kubernetes, IAM, infrastructure as code, and application security. As the first dedicated product security hire, the engineer will define the security roadmap and partner closely with product and platform engineering teams. This is a high-autonomy, remote individual-contributor role for an experienced security professional.[Apply for this job](#job-application)[View company](https://jobicy.com/company/upguard.md)ShareRemote from[Australia](https://jobicy.com/job-region/australia.md)SalaryUndisclosedDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceDirectorPublished13 Nov 2026Apply before13 Dec 2026Listing views49Application actions3Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. ### Who are we? At [UpGuard](https://jobicy.com/company/upguard.md), we are replacing manual security bottlenecks with AI-driven precision. Fresh off a US$75M Series C, we are scaling our infrastructure to process 100 billion risk signals daily. This isn’t just growth; it’s a total reimagining of how the world manages cyber risk. We build the Cyber Risk Posture Management (CRPM) platform that security teams actually love. By integrating security ratings, threat intel, and agentic AI, we empower organisations to stay ahead of an ever evolving attack surface. We aren’t just building another tool; we’re defining a category. We provide the autonomy to ship world-class technology and the resources to do it at a global scale. ### About the role This is UpGuard’s first dedicated product security hire. You’ll have significant ownership over the direction of product security at UpGuard as we scale. You won’t be inheriting someone else’s decisions. You’ll be defining the security standards, tooling, and practices that protect UpGuard’s products and infrastructure for years to come. In this role, you’ll work across our product and production environments: performing security reviews, managing vulnerabilities, and running detection and response operations in our cloud-native infrastructure. You’ll collaborate closely with our product engineering and platform teams to secure our products, CI/CD pipelines, and production systems, and to embed security into how we build from the ground up. The full remit of product security is broad, so we’ve been deliberate about sequencing. In your first 6–12 months you’ll: * Refresh threat modelling and security review as a standard part of how we ship. * Figure out where AI actually helps in AppSec (code review, triage, coverage) and build what works * Harden our GCP and Kubernetes baseline and get secure-by-default configs into infrastructure-as-code The function sits at the heart of our engineering organisation, and you’ll have genuine autonomy and influence: defining the security roadmap, driving best practices, and scaling our security posture as we grow. This is a Staff-level individual contributor role. ### What you’ll do * Lead threat modelling and security reviews across UpGuard’s product portfolio and cloud infrastructure, proactively surfacing attack vectors and designing mitigation strategies that scale with growth. * Build automation, policy-as-code, and AI-driven security tooling that lets product engineering teams “shift left” and embeds security across the SDLC, leveraging agentic workflows to triage, review, and scale the reach of a lean security function. * Design and implement secure-by-default configurations for cloud and Kubernetes infrastructure. * Own vulnerability management end-to-end, triaging and prioritizing by real risk, driving remediation with engineering teams, and building preventative controls across the software supply chain from development through production. * Build scalable detection and response systems that catch malicious activity, triage the noise, and run incidents end to end. * Build deep partnerships with our product engineering and platform teams, helping them deliver secure-by-design solutions. You’ll be building a function, not inheriting one; with real executive backing, at a company where product security is core to the business rather than a cost centre. Our engineering culture values iteration, collaboration, and speed, with a no-ego approach and pragmatic trade-offs. We’re fully remote with optional offices in Sydney and Hobart, and no mandatory office attendance. ### What you’ll bring * 7+ years of experience in security engineering and/or software engineering/or security operations, work in cloud environments, with a focus on the below: * Cloud security experience (GCP preferred, but AWS or Azure is welcome) * Cloud native Kubernetes services (EKS/GKE/AKS) and strong container security principles * Strong understanding of securing IAM and cloud identities * Experience leading technical security reviews of products and architectures, running threat modelling exercises, and turning findings into security controls engineering teams can implement. * Strong knowledge of common web application vulnerabilities and how to prevent them (OWASP Top 10 and similar). * Hands-on experience with IAC and related tools (preferably Terraform/OpenTofu) ### What will give you an edge? * Experience as the first security hire or founding member of a security function at a scaling company. * Familiarity with AI/LLM security risks (e.g. OWASP LLM Top 10) and securing AI-powered product features. * Strong backend engineering skills, particularly in Go * Experience supporting SOC 2 / ISO 27001 audits from an engineering perspective. * Public security research, CVEs, open-source security tooling, or conference talks. * Offensive security skills, with the ability to validate findings through hands-on exploitation. ### What’s in it for you? * WFH set-up allowance: To ensure you have the right environment to work in, we will help you get set up within your first 3 months at UpGuard * Monthly Lifestyle subsidy: Use this for financial, physical, and mental well-being * $1500 USD annual Learning & Development allowance: To support your career development, all team members will be able to expense development opportunities against this allowance * Annual leave: PTO plus two additional UpGuardian leave days to give you time to recharge your batteries. * 18 weeks paid Parental Leave: Irrespective of parenting role * Personal Leave Allowance: This includes sick & carer’s leave * Fully remote working environment: While we have physical offices in Sydney & Hobart, we do not mandate compulsory attendance * Top-spec hardware: All team members will be provided with top-spec laptops for their role * Generative AI subsidy: UpGuard provides paid subscriptions for all team members to access generative AI tools to support their work. * Stock options: Share in UpGuard’s growth and long-term success UpGuard is a Certified Great Place to Work® in the US, Australia, UK and India, establishing its position as a leading global technology employer. 99% of team members agree that UpGuard is a great place to work! Apply now to find out why! As an Equal Employment Opportunity and Affirmative Action Employer, qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender perception or identity, national origin, age, marital status, protected veteran status, or disability status. Please Note: Not all roles can be performed from the United States. Please check your specific job listing to confirm its advertised location. If the role you are applying for is listed as based in the US, we are currently only able to support hiring in the following locations: CA, CO, FL, IL, MA, MD, MO, OR, PA, TX, WA, and DC. Before starting work with us, you will need to undertake a national police history check and reference checks. Show more [Apply now >](https://jobicy.com/jobs/161789-staff-security-engineer-product-cloud.md) > Annual salary information is not provided for this position. Explore salary ranges for similar roles in our [Salary Directory ›](https://jobicy.com/salaries.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThis is a staff-level founding security role spanning application security, cloud security, incident response, and security program design. Success requires deep technical judgment as well as the ability to influence engineering teams and build scalable practices from scratch. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Highly competitive$205,000US market range (per year)$180k–$230k0$253.00k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. No base salary was disclosed. The annual compensation estimates are inferred for a staff-level product and cloud security engineer role with broad ownership and remote work scope; they are not employer-provided figures. ## Core skills Skills and capabilities most closely associated with this opportunity. [Product Security](https://jobicy.com/jobs?search_keywords=Product%20Security.md)[Cloud Security](https://jobicy.com/jobs?search_keywords=Cloud%20Security.md)[GCP](https://jobicy.com/jobs?search_keywords=GCP.md)[Kubernetes Security](https://jobicy.com/jobs?search_keywords=Kubernetes%20Security.md)[Threat Modeling](https://jobicy.com/jobs?search_keywords=Threat%20Modeling.md)[Application Security](https://jobicy.com/jobs?search_keywords=Application%20Security.md)[Vulnerability Management](https://jobicy.com/jobs?search_keywords=Vulnerability%20Management.md)[Incident Response](https://jobicy.com/jobs?search_keywords=Incident%20Response.md)[Infrastructure as Code](https://jobicy.com/jobs?search_keywords=Infrastructure%20as%20Code.md)[Terraform](https://jobicy.com/jobs?search_keywords=Terraform.md)[IAM Security](https://jobicy.com/jobs?search_keywords=IAM%20Security.md)[CI/CD Security](https://jobicy.com/jobs?search_keywords=CICD%20Security.md)[Security Automation](https://jobicy.com/jobs?search_keywords=Security%20Automation.md)[OWASP Top 10](https://jobicy.com/jobs?search_keywords=OWASP%20Top%2010.md)[Policy as Code](https://jobicy.com/jobs?search_keywords=Policy%20as%20Code.md) Sample interview questionsHow would you establish a product security program as the first dedicated security engineer?I would begin by mapping the product architecture, development lifecycle, cloud estate, critical data flows, and current control maturity. I would prioritize a small number of high-impact foundations: threat modeling, security review criteria, vulnerability triage, cloud baseline controls, and clear ownership paths. I would then publish a risk-based roadmap with measurable outcomes and embed lightweight security practices into existing engineering workflows. How do you conduct an effective threat-modeling session with a product engineering team? I prepare by understanding the architecture, trust boundaries, assets, identities, and external dependencies. During the session, I facilitate discussion around realistic abuse cases and attack paths rather than using a checklist mechanically. The output is a prioritized set of actionable mitigations, assigned owners, and follow-up verification integrated into the team's delivery plan. What controls would you prioritize for securing a GCP and Kubernetes environment? I would prioritize least-privilege IAM, strong workload identity, centralized logging and alerting, hardened network boundaries, secrets management, and organization-level policy controls. For Kubernetes, I would establish secure cluster configuration, admission controls, image provenance and scanning, namespace isolation, runtime visibility, and restricted workload permissions. These controls should be expressed through infrastructure as code and continuously validated. How would you improve vulnerability management beyond simply tracking scanner findings? I would build a risk-based process that combines exploitability, asset criticality, internet exposure, privilege level, and available compensating controls. Findings should have clear ownership, remediation targets, exception handling, and verification of closure. I would also analyze recurring root causes and use preventive measures such as dependency policies, secure templates, and CI/CD guardrails to reduce future volume. How would you evaluate the use of AI in application security workflows? I would start with bounded use cases such as alert triage, code-review assistance, evidence gathering, and security-control coverage analysis. Each use case should be tested against accuracy, false-positive risk, data handling requirements, auditability, and impact on engineer workflows. AI should augment expert judgment, with clear human review for high-risk decisions and protections against prompt injection, sensitive-data leakage, and unsafe automated changes. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![TITAN logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/81b82aeb-221.png) TITAN Nov 13 New ### [Chief Information Security Officer (CISO), RFA](https://jobicy.com/jobs/161782-chief-information-security-officer-ciso-rfa.md) About RFA and Titan RFA is a leading IT and cybersecurity partner to financial services firms: hedge funds, private equity, asset managers, and the firms that serve them. RFA is… * ![Nebius logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/d90c0566-221.webp) Nebius Nov 13 New ### [Detection & Response Engineer](https://jobicy.com/jobs/161755-detection-response-engineer-2.md) About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from… * ![Canonical logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/b4d068a9-221-1.png) Canonical Nov 12 New ### [Linux Cryptography and Security Engineer](https://jobicy.com/jobs/161678-linux-cryptography-and-security-engineer.md) This is a unique opportunity to use your software engineering and cryptography skills to build and maintain the security foundation that enables Ubuntu and its users to operate securely and… * ![Latent logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/c872d1ae22b7-221.webp) Latent Nov 12 New ### [Security Engineer](https://jobicy.com/jobs/161597-security-engineer-7.md) About Latent Latent is the enterprise pharmacy intelligence platform, powered by a clinical agentic engine, that enables health systems to grow their pharmacy operations and serve more patients. One engine… * ![Workleap logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/b84329e1-221.png) Workleap Nov 12 New ### [Staff Security Operations Specialist, LeapSec](https://jobicy.com/jobs/161595-staff-security-operations-specialist-leapsec.md) Company Description Workleap is a Montreal-based tech company, founded in 2006. We’re builders at heart, we make simple products that actually matter to the people who use them. We have… * ![Samsara logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/dd26f5ca-221.jpg) Samsara Nov 12 New ### [Senior Security Engineer – Enterprise Security](https://jobicy.com/jobs/161583-senior-security-engineer-enterprise-security.md) Who we are Samsara (NYSE: IOT) is the pioneer of the Connected Operations™ Cloud, which is a platform that enables organizations that depend on physical operations to harness Internet of… * ![Bogaard Group International logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/1ccf014fc152-221.webp) Bogaard Group International Nov 12 New ### [Lead Security Systems Solutions Engineer](https://jobicy.com/jobs/161571-lead-security-systems-solutions-engineer.md) Position Overview We are looking for an experienced Lead Security Systems Solutions Engineer to be embedded at a leading global technology and entertainment company. The Lead Security Systems Solutions Engineer… * ![Dropbox logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/09/WRILS-200923071227-398427.jpg) Dropbox Nov 12 New ### [Security Engineer, IAM](https://jobicy.com/jobs/161544-security-engineer-iam.md) Role Description Security Engineers at Dropbox safeguard our digital ecosystem alongside a diverse team of professionals dedicated to protecting our products and users. Trusted by millions, our mission is to… * ![Fleetio logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/07/e571b83c37e0ed5371754d319be16e76.jpeg) Fleetio Nov 12 New ### [Senior Security Operations Engineer](https://jobicy.com/jobs/161527-senior-security-operations-engineer-5.md) A little about us…Fleetio is a modern software platform that helps thousands of organizations worldwide manage their fleet operations. Transportation technology is a hot market, and we’re leading the charge… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Nov 12 New ### [Senior Blockchain Intelligence Analyst, Ransomware](https://jobicy.com/jobs/155136-senior-blockchain-intelligence-analyst-ransomware.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… [Browse all jobs](https://jobicy.com/jobs.md)