Opportunity at
DruvaSenior Staff Engineer, Product Security
This is a full-time, on-site product security leadership position covering Druva's SaaS offerings and the AI capabilities the company is adding. The Senior Staff Product Security…
Career Tools
About This Role
This is a full-time, on-site product security leadership position covering Druva's SaaS offerings and the AI capabilities the company is adding. The Senior Staff Product Security Engineer helps shape an AI-first software lifecycle that blends classic application security with AI-specific controls, automates early (shift-left) checks, and writes threat models for the main services and for advanced AI designs. A large share of the work is wiring security checks into build…
Job Description
This is a full-time, on-site product security leadership position covering Druva's SaaS offerings and the AI capabilities the company is adding. The Senior Staff Product Security Engineer helps shape an AI-first software lifecycle that blends classic application security with AI-specific controls, automates early (shift-left) checks, and writes threat models for the main services and for advanced AI designs.
A large share of the work is wiring security checks into build pipelines and developer tooling. Those checks include static and dynamic analysis, software composition analysis, container scanning and secret detection. The engineer also uses AI for jobs such as sorting findings, drafting threat models and suggesting remediations, while defining controls for the AI features offered to customers.
Threat modeling extends to generative and agentic AI, including connectors built on MCP, self-directed agents, function-calling layers, multi-agent messaging, prompt injection, and memory or context poisoning. The role reviews code, mainly in Python, Go and JavaScript, helps engineers land quick and lasting fixes, and manages open-source dependency risk, software bills of materials and the security of MCP and agent server ecosystems.
The position also runs enablement: secure coding workshops, training on safe AI use, and growing a network of security champions across engineering. It works with engineering leadership, the information security team, GRC, BuildOps and DevOps. The posting asks for six to ten years of product security engineering in a SaaS setting, with a record of technical leadership and depth in the OWASP Top 10, CWE 25, cryptography, container hardening and software development lifecycle security frameworks.
Responsibilities
- Build security controls covering SAST, DAST, SCA, container and secrets scanning into CI/CD pipelines
- Draft threat models and triage findings with AI tooling
- Assess risks in generative and agentic AI, including prompt injection and memory poisoning
- Help engineers land fixes that are quick now and durable later
- Manage open-source risk, SBOMs and the security of MCP and agent server ecosystems
- Run secure coding workshops and grow the Security Champions network
Requirements
- Between six and ten years in product security, mostly for SaaS platforms
- Record of technical leadership across security engineering work
- Deep command of the OWASP Top 10, CWE 25 and threat modeling
- Hands-on skill with AI-first SDLC methods and with AI security risks for agentic systems
- Reviewing code and scripting in Python, Go or JavaScript
- Working knowledge of MCP security issues: authorization, tool poisoning and confused deputy risks
Qualifications
- Knowledge of cryptography, container hardening, and frameworks such as SAMM and Microsoft SDL
- Experience using AI tools to speed up security work such as root-cause analysis and policy generation
- Practical work with Burp Suite, Snyk and OWASP ZAP, plus CI/CD scanners
- Hands-on development experience, a major plus
- Bachelor's degree in computer science, IT or equivalent
- Certifications such as OSCP, OSWE, CSSLP or GIAC, or community work with OWASP, BSides, NullCon or Black Hat
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Where is the role located?
The posting lists the role as on-site but does not name a city or office.
What is the salary?
The posting does not specify salary or benefits.
What experience is required?
The posting asks for six to ten years in product security for SaaS, with technical leadership experience and depth in the OWASP Top 10 and secure development practice.
Is this a full-time position?
Yes. The posting lists the role as full-time.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.