Senior Product Security Engineer

Priority Commerce is hiring a Senior Product Security Engineer to embed security throughout the software development lifecycle and help secure its commerce platform. The role partners with Engineering, Product, Legal, and Compliance to identify and mitigate risks, guide secure architecture, and scale security practices and tooling.

Responsibilities:

• Own security design reviews and threat modeling for high-risk product areas including payment processing, identity and access, fraud systems, and AI
• Serve as a technical security authority for staff and principal engineers, providing guidance on secure architecture patterns, cryptography, and API security
• Lead and execute application security assessments, red team exercises, and adversarial simulations against production and pre-production environments
• Define and drive adoption of security standards, secure coding guidelines, and SAST/DAST/SCA tooling across engineering teams
• Partner with the Engineering and DevOps teams to mature the security posture of CI/CD pipelines, cloud infrastructure, and container environments
• Translate complex security risks into clear, prioritized recommendations for engineering leadership and product managers
• Contribute to the team's regulatory compliance posture across PCI-DSS, SOC 2 Type II, and other applicable regulatory guidance

Requirements:

• 5 years of experience in application security, product security, or a closely related technical role (e.g., DevOps or Application Development)
• Experience in application security, product security, or a closely related technical role
• Deep expertise in at least two of the following security domains: web application security, API security, mobile security (iOS/Android), or cloud security (AWS preferred)
• Strong proficiency in one or more programming languages (Python, Java, JavaScript, etc.), demonstrating the ability to read, write, and reason about production code
• Experience with modern software development and application security tooling (SAST, DAST, SCA, etc.)
• Hands-on experience with threat modeling methodologies applied to complex distributed systems
• Familiarity with security frameworks and standards relevant to fintech such as PCI-DSS, SOC 2 Type II, FFIEC, NIST CSF, and ISO 27001
• Strong written and verbal communication skills with the ability to communicate effectively with both technical and business audiences
• Experience securing fintech, payments, or regulated financial products
• Experience supporting cloud-native architectures and modern CI/CD environments
• Experience participating in red team exercises, penetration testing, or adversarial simulations
• Security certifications such as CISSP, CSSLP, OSCP, GIAC, or similar credentials
• Experience working closely with engineering organizations in highly regulated environments