Senior Product Security Engineer, ExtraHop
Application Security
$136.6-180k
+ Bonus
Cloud-native cyber security platform
Be an early applicant
Cloud-native cyber security platform
501-1000 employees
Be an early applicant
$136.6-180k
+ Bonus
501-1000 employees
Company mission
To reveal cyber risk and build business resilience by exposing threats organizations can't see.
Role
Who you are
- ExtraHop is seeking a Senior Product Security Engineer, experienced with modern software development practices to build and operate product security program capabilities, tools, and processes that allow us to keep pace with a rapidly changing security landscape, reduce security risk and enable organizational success
- We're looking for candidates with a mix of software development and application security experience, who enjoy working in a collaborative environment and taking direct action to identify, remediate and prevent vulnerabilities and security issues
- You must have experience with securing web applications, APIs and software systems, working with public cloud infrastructure, and be familiar with container technologies
- Bachelor’s degree or equivalent experience in computer science, engineering, or information technology
- 8+ years of experience in security engineering, application security and software development
- Experience securing cloud-based web applications, APIs, data; performing security design reviews, code reviews and threat modeling exercises
- Knowledge of software security vulnerabilities and best practices for Golang, Typescript, Javascript, Python, C/C++, React
- Solid knowledge of Git
- Experience working with container-based environments (Kubernetes, Docker, LXC, etc.)
- Experience with AWS cloud platform
- Must be a U.S. citizen
Desirable
- Obtained applicable certifications for software security, web application penetration testing or equivalent
- Experience securing a cloud service (i.e., software as a service (SaaS)) offerings and shippable software products
- Experience with meeting FedRAMP, NIST SP 800-53 and similar compliance requirements
- Experience with Google Cloud Platform (GCP) and Azure
- Experience deploying and maintaining systems using modern Orchestration and Infrastructure-as-Code technologies
What the job involves
- Define standards for secure development and configuration of application and infrastructure components; and coordinate with other teams to ensure compliance with those standards
- Perform threat modeling, security design reviews, code reviews, and security consultations with software and systems engineers
- Implement, manage and improve vulnerability scanning tools (including SAST, DAST, SCA, and application fuzzing), configuration auditing and other security assessment tools
- Build and improve vulnerability management processes and tooling to support system owners to successfully
- Conduct manual pen testing of new features + existing systems; lead red team exercises
- Coordinate third party pentesting and bug bounty programs
- Triage vulnerability findings, evaluate risk, recommend effective remediation actions
- Develop and deliver training on secure development standards and process
- Contribute to disaster recovery and contingency planning
- Perform and/or lead security incident response activities
- Participate in an on-call rotation with occasional after-hours paging to review carefully prioritized security detections
- Support security compliance & certifications programs (e.g., FedRAMP, NIST SP800-53, NIST CSF, SOC 2, ISO, FIPS 140-2, etc.) by becoming familiar with control requirements, owning/operating specific controls, and helping other teams meet requirements
- Other duties as assigned
Our take
When trying to become more cybersecure, many businesses find themselves operating blindly, as they lack the necessary insights to understand potential attack points within their networks. This information gap has led to an alarming vulnerability, leaving organizations exposed to threats that remain unseen.
ExtraHop has emerged to provide organizations with the network visibility and threat detection capabilities they need. Through its cyber defense platform, the company enables businesses to detect and respond to advanced cyber threats before they can compromise their operations. Importantly, its use of cloud-scale AI and ML means this is done in real time.
With a portfolio of over 70 AI and ML patents, ExtraHop has built a reputation as an innovator in the space. It has been able to accelerate growth since its acquisition by Bain Capital and Crosspoint Capital in 2021, and fresh funding will ensure it is able to continue expanding capabilities and reinforcing its already strong position.
Kirsty
Company Specialist at Welcome to the Jungle
Insights
Company
Funding (last 2 of 5 rounds)
Jan 2024
$100m
GROWTH EQUITY VC
May 2014
$41m
SERIES C
Total funding: $161.6m
Company benefits
- 100% insurance cost covered for employee (80% for family)
- Flexible PTO Policy
- Well-stocked kitchen, including fruit, juice, coffee and espresso machines, and six kegerator
- Employees have the opportunity to invest in a 401(k) and company stock options
- Tuition reimbursement program for continuing education
- Each employee is granted three days a year to spend in service to the community
Company HQ
Pike Pine Retail Core, Seattle, WA
Articles
Leadership
Jesse Rothstein
(Board of Directors)Has previously been both CEO and CTO of the company. Was a Senior Architect at F5 Networks and Senior Software Developer at Motive Communications.
Raja Mukerji
(Chief Scientist)Has previously been both President and Chief Customer Officer of the company. Was a Senior Architect at F5 Networks and Senior Engineer for Strong Capital Management.
Share this job
View 10 more jobs at ExtraHop