Senior Product Security Engineer, Iru
Contract
Apple device management platform
Be an early applicant
Apple device management platform
201-500 employees
Be an early applicant
201-500 employees
Company mission
To harmonize technology and security through innovative software that powers secure and productive global work.
Role
Who you are
- 5+ years in Product Security or Application Security
- Strong understanding of modern application architectures
- Experience securing:
- Web applications
- APIs
- Microservices
- Cloud-native applications
- Experience performing threat modeling
- Experience conducting penetration testing
- Strong understanding of:
- OWASP Top 10
- OWASP API Top 10
- Authentication & Authorization
- OAuth / OIDC
- Secure SDLC
- Experience with SAST, DAST, SCA, and container security
- Experience partnering directly with engineering teams
- Strong written and verbal communication skills
Desirable
- Experience securing AI/LLM applications
- Experience with Kubernetes and containers
- Familiarity with cloud security (AWS, Azure, or GCP)
- Experience with GitHub Actions or CI/CD security
- Experience using:
- Snyk
- Burp Suite Pro
- Semgrep
- Wiz
- GitHub Advanced Security
- Security certifications such as OSCP, GWAPT, GWEB, CSSLP, or CISSP are a plus
What the job involves
- We're seeking a highly technical Senior Product Security Engineer for a 6-month contract (40 hours/week) to embed security into the product development lifecycle. This is a hands-on engineering role responsible for identifying security risks early, partnering with development teams on remediation, conducting security reviews, performing application security testing, and helping build secure-by-design products
- This role will work closely with Engineering, Cloud Security, Infrastructure, Compliance, and Product Management to ensure security is integrated throughout the SDLC while enabling developer velocity
- Application Security
- Perform security design and architecture reviews for new products and features
- Conduct threat modeling for applications, APIs, and AI-enabled services
- Review application security posture throughout the SDLC
- Partner with engineering teams to prioritize and remediate vulnerabilities
- Review authentication, authorization, and access control implementations
- Security Testing
- Perform manual web, API, thick-client, and mobile application penetration testing
- Validate findings from third-party penetration tests
- Conduct secure code reviews
- Verify remediation of security vulnerabilities
- Secure Development
- Drive adoption of secure coding practices
- Partner with developers to improve security throughout the SDLC
- Help define Product Security standards and engineering guardrails
- Develop reusable security patterns and reference architectures
- Vulnerability Management
- Triage findings from SAST, DAST, SCA, container scanning, and cloud security tools
- Work with engineering teams to prioritize remediation
- Track remediation SLAs and security metrics
- AI Security
- Assess AI-enabled products for security risks
- Review LLM integrations and AI workflows
- Test AI applications for prompt injection, data leakage, insecure tool use, model abuse, and authorization weaknesses
- Help define secure AI engineering standards
- Security Automation
- Improve automation of security testing throughout CI/CD
- Integrate security tooling into developer workflows
- Build scripts and tooling that reduce manual security work
- Cross-functional Partnership
- Collaborate with Product, Engineering, Infrastructure, Cloud Security, and Compliance teams
- Support customer security questionnaires related to product security
- Assist Sales Engineering with security discussions when needed
Our take
Device and application management are essential for the maintenance of an IT stack, with particular emphasis on frequent updating and compliance. This can be a laborious and repetitive task, so management software exists to automate these processes. However, existing solutions are generally aimed towards IT departments running on Windows.
Iru, formerly Kandji, provides a mobile device management platform that facilitates the remote maintenance of Apple-based IT stacks. Users can manage IT devices, applications, networking and compliance within a zero-touch automation system. The need for this service in companies using Apple hardware is clear: it has been adopted by major enterprises such as Belkin, Crunchbase and Notion.
As the Apple device management market is also expanding at speed, Iru is well poised to continue its run of success. It has raised significant funding across several rounds, the latest of which came in 2024 and helped it launch its new AI-powered unified IT and security platform. This new product signifies a new approach to IT and security management and exemplifies Iru's ability to continuously innovate its market.
Freddie
Company Specialist at Welcome to the Jungle
Insights
-5% employee growth in 12 months
Company
Funding (last 2 of 6 rounds)
Jul 2024
$100m
SERIES D
Nov 2021
$100m
SERIES C
Total funding: $288.4m
Company benefits
- Health Coverage - 100% individual and dependent medical + dental + vision coverage
- Flexible Spending Account
- Equity for full-time employees
- New MacBook Pro and software setup
- Exciting opportunities for career growth
- An outstanding, inclusive culture
- 4% 401k company match
- Monthly Uber Eats meal credit
- $1,000 Home Office Equipment Stipend
- $50 monthly Internet reimbursement
- Equipment discounts
- Week long company shutdown, first week of August
- 10 Health and Wellness Days
- 12 weeks of Paid Parental Leave
- 14 Holidays
Company HQ
Downtown San Diego, San Diego, CA
Leadership
Adam Pettit
(Founder & CEO)They started their career in Solutions at Apple before working as President of AMP Consulting and spending 9 years as CEO of Interlaced, which they founded. They left to found Kandji in 2018 as CEO.
Share this job
View 19 more jobs at Iru