Product Security Engineer

At Doppel, we focus on building a culture where people feel respected, supported, and trusted to do meaningful work. We value clarity, collaboration, and solving real problems for our customers and teammates.

What You Will Do

• Partner with product and engineering teams on architecture reviews, threat modeling, and secure design, translating complex security risks into practical recommendations and clear tradeoffs.

• Evaluate and roll out AI-assisted and agentic security workflows to increase security coverage and accelerate reviews, triage, and remediation, with appropriate validation and human oversight.

• Improve and maintain our first- and third-party security tooling, including our in-house ASPM platform, to reduce noise, improve prioritization, and make findings easier for engineering teams to act on.

• Strengthen security controls throughout the SDLC and CI/CD pipeline, including code and dependency scanning, software supply chain protections, and safeguards for AI-assisted development, without introducing unnecessary friction.

• Serve as a GCP security subject matter expert, advising engineering teams on secure patterns for networking, data protection, secrets management, workload runtimes, and logging and monitoring.

• Partner with infrastructure and engineering teams to implement least-privilege IAM, secure workload identities, and durable security guardrails through policy and infrastructure-as-code.

• Drive vulnerability management from triage through resolution: validate findings, assess risk, establish ownership, track remediation against SLAs, and document exceptions and risk acceptance.

• Coordinate penetration testing engagements, including vendor selection, scoping, testing logistics, findings validation, and remediation and retesting with engineering teams.

• Help shape and scale our product security program by identifying gaps, prioritizing improvements, and communicating risk, progress, and outcomes to security leadership.

• Enable engineers to make sound security decisions through practical documentation, reusable guidance, targeted training, and mentorship that keeps pace with how teams build and ship.