Senior Product Security Engineer

Cloudflare is on a mission to help build a better Internet by protecting and accelerating any Internet application online. As a Senior Product Security Engineer, you will lead security assessments and vulnerability operations for Cloudflare’s core software products, ensuring that product-related security findings are accurately triaged and mitigated.

Responsibilities:

• Autonomously Drive AI Security Innovation: Proactively identify gaps in our current capabilities and independently architect, build, and deploy AI-driven solutions to automate code analysis, optimize triage, and scale Product Security workflows
• Security Architecture & Threat Modeling: Lead deep-dive security reviews and complex threat modeling sessions across distributed systems, embedding strict security requirements into product designs before development begins
• Product-Focused Vulnerability Management: Own the lifecycle of product security findings. Ensure vulnerabilities are accurately triaged, mapped to the correct engineering owner, and mitigated in alignment with established SLAs
• Bug Bounty Leadership: Oversee the technical triage and validation of Cloudflare’s external Bug Bounty program, prioritizing submissions based on real-world exploitability and business risk
• Pentest Strategy & Support: Shape the scope of internal and external penetration testing engagements, serving as the technical liaison to ensure findings are deeply understood and remediated by development teams
• Strategic Influence & Mentorship: Act as a force-multiplier for security across Cloudflare; mentor junior engineers, cultivate security champions within engineering organizations, and establish modern, paved-road developer guardrails

Requirements:

• Extensive, battle-tested experience in Product or Application Security within large-scale distributed cloud environments or SaaS platforms
• Demonstrated ability to build production-grade automation scripts and tools
• Hands-on engineering experience leveraging AI/LLMs to solve operational or technical challenges
• Mastery of threat modeling methodologies (e.g., STRIDE) and an analytical mindset capable of translating complex theoretical risks into prioritized, actionable business context
• Proven track record of managing, routing, and driving the remediation of vulnerabilities across multi-stakeholder engineering organizations while strictly enforcing SLAs
• Superb cross-functional leadership skills; the ability to confidently influence senior engineering leaders, resolve ownership ambiguity, and champion security initiatives without explicit authority
• Familiarity with offensive security tooling and modern exploitation techniques used during professional penetration testing
• Experience scaling crowdsourced security programs (e.g., HackerOne, Bugcrowd) or optimizing agile project management workflows within JIRA
• Experience in integrating hardware security features into production code bases