Principal Product Security Engineer
Cribl · Remote - United States
About this role
**Join the company that’s building the telemetry infrastructure for the AI era.** Cribl partners with IT and Security teams at many of the world’s biggest enterprises to bridge the gap between AI ambition and infrastructure reality. As the AI Platform for Telemetry, Cribl gives customers the choice, control, and flexibility to manage and analyze telemetry for both humans and agents. --- ## Why You’ll Love This Role Cribl is seeking a **Principal Product Security Engineer** to serve as a hands-on technical authority at the intersection of **application, cloud, and FedRAMP environment security**. You’ll help secure Cribl’s **cloud-native, customer-managed, and hybrid products** that process high-volume data for large organizations. This is **not** a documentation-only compliance role. You’ll work closely with **Engineering, SRE, Cloud Operations, Compliance, and PSIRT** to turn regulatory commitments into real product architecture and day-to-day operations. --- ## What You’ll Do - Set long-term **product and cloud security direction** across multiple teams (roadmaps, standards, secure-by-default patterns, risk-informed release decisions). - Lead **Product Security Reviews** for distributed, multi-tenant SaaS and customer-managed products (architecture/design review, threat modeling, abuse-case analysis, secure code review, security test planning). - Translate risk into **engineering requirements, mitigations, tests, and secure defaults**, then independently verify outcomes. - Serve as a principal authority across **IAM/workload identity, boundaries, network exposure, KMS/encryption, secrets, logging & detection, containers/Kubernetes, serverless, IaC, hardening, and data isolation**. - Lead the **Product Security component of FedRAMP engineering** (Moderate/NIST SP 800-53 control intent → technical controls & defensible evidence; support authorization boundary and significant-change decisions; continuous monitoring; vulnerability/change management; POA&M/deviation remediation; incident response; vendor assessments; 3PAO/assessor interactions). - Investigate ambiguous signals and vulnerabilities from **bug bounty, scanners, penetration tests, cloud detections, and internal reports**; assess exploitability/exposure/impact; coordinate remediation; validate fixes/bypasses; hunt variants and root causes. - Evolve **risk-adaptive vulnerability management** using exposure, exploitability, **CISA KEV** signals, asset criticality, customer impact, and regulatory timelines (not CVSS alone). - Build and operate durable security capabilities and “developer paved roads” across **CI/CD, SAST, SCA, secrets, IaC, containers, cloud posture, and testing**—automating repeatable work while preserving human judgment. - Scope and oversee **external penetration tests, purple-team exercises, and security vendors**; ensure findings become owned, verified engineering outcomes. - Lead multi-team work through uncertainty and high-stakes situations; balance security, reliability, delivery, customer impact, and compliance. - Communicate complex risks and recommendations clearly to engineers, leaders, customers, assessors, and partners. - Multiply the team by mentoring Product Security engineers and security champions; create standards, runbooks, automation, and continuity plans. - Evaluate and responsibly apply emerging technologies (including **AI-assisted security engineering**) with measurable outcomes and clear human accountability. - Participate in **stand-
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.