Senior Product Security Engineer

In this role you will strengthen product security across the SDLC, partnering with engineering and product teams to identify risks and implement practical security solutions. You will perform hands-on security reviews of applications, APIs, and code, and drive remediation and secure-by-design practices. You’ll model threats, analyze security findings, and automate security checks to protect modern web apps, APIs, and cloud-native services. This position offers a chance to shape Tipalti’s security posture while working in a collaborative, fast-paced environment.

• competitive benefits
• flexible workplace
• career coaching
• diverse and inclusive environment
• global team
• opportunity to impact worldwide customers

• Collaborate with development and product teams to integrate security across the SDLC
• Conduct hands-on security reviews of applications, APIs, services, and code
• Identify, investigate, validate, and assess product security vulnerabilities
• Provide remediation guidance and assist teams through remediation
• Perform threat modeling and security analysis for new and existing capabilities
• Work with security tooling (SAST, SCA, DAST, API Security, WAF) and implement security controls
• Improve and automate Product Security processes, tooling, and checks across the lifecycle
• Assess security across web apps, APIs, microservices, containers, Kubernetes, and cloud-native environments
• Support secure coding practices and provide practical guidance to developers
• Support vulnerability disclosure and Bug Bounty activities, including validation and risk assessment
• Contribute to continuous improvement of Product Security practices across engineering

• 5+ years of hands-on experience in Application Security or Product Security
• Strong ability to read and review code in .NET, JavaScript/TypeScript, or modern technologies
• Experience identifying and analyzing application and API security vulnerabilities
• Experience with threat modeling and application security reviews
• Solid understanding of authentication, authorization, session management, web and API security, and mobile security
• Strong knowledge of OWASP Top 10 and practical remediation
• Hands-on experience with SAST, SCA, DAST, API Security, WAF
• Experience with microservices, APIs, containers, Kubernetes, and cloud-native environments
• Knowledge of AWS and/or Azure security
• Understanding of modern CI/CD and software development environments
• Strong analytical, problem-solving, and communication skills

• strong communication and collaboration
• ability to translate security findings into practical guidance
• cross-functional teamwork
• SAST
• SCA
• DAST