Staff AppSec / Product Security Engineer - Filigran

The Company

Founded in 2022, Filigran is a global cybersecurity company on a mission to empower defense teams to be proactive through open-source solutions that uncover threats and drive action.

Filigran stands out in the cybersecurity ecosystem through its open-source, AI-powered, and threat-informed approach to Continuous Threat Exposure Management (CTEM). Our eXtended Threat Management (XTM) platform brings together threat intelligence, exposure validation, and cyber risk reduction, enabling organizations to better understand their threat landscape and take action.

At the heart of Filigran is our open-source approach. Our vision is to unite defenders into a global community to make security more open, resilient, and collaborative. Our CORE values—Cohesion, Openness, Responsibility, and Equity—shape how we work together, make decisions, and build for the future.

The Role

We're looking for a Staff AppSec / Product Security Engineer to join our Digital Security team and make security a built-in quality of everything we ship across the XTM platform (OpenCTI, OpenAEV, XTM One, XTM Hub). You'll work closely with the R&D team: the VP, Staff and Principal Engineers, Engineering Managers, Product Owners, and the Product Manager to keep our open-source and enterprise products trustworthy for 6,000+ organizations.

As a Staff engineer, you advise the CISO on product security and turn their strategy into day-to-day practice in the product teams. You lead security as a cross-cutting concern, coach engineers, and contribute directly with critical security fixes, PR reviews, pair programming, and shared security components.

Your Responsibilities

• Leverage AI tools and methodologies to boost productivity and impact.
• Contribute to building AI capabilities into internal workflows.
• Advise the CISO on product security strategy across the XTM platform, and lead operational implementation in product teams.
• Lead threat modeling and security reviews in feature refinements with Product Owners (authentication, RBAC, multi-tenancy, connectors, GraphQL API, and AI/agent features).
• Ensure stack security quality through critical PRs, fixes, code reviews, and building shared, secure-by-default components.
• Drive secure SDLC and supply chain tooling in CI (SAST, SCA, secret and container scanning, Renovate, Snyk, SBOMs, signed releases).
• Run product vulnerability management: intake from open source community, bug bounty, coordinated disclosure, CVEs, advisories, remediation SLAs, and incident handling.
• Mentor engineers and grow security champions through pairing, workshops, and continuous feedback. Document security architecture decisions.

Who You'll Work With

• Reports to: The CISO, as part of the Digital Security team.
• Key Collaborators: R&D engineering teams, Product Owners, Platform Engineering (SOC 2 Type 2, ISO 27001:2022, FedRamp), and Customer Success.
• Community: OpenCTI and OpenAEV open-source contributors and security researchers reporting vulnerabilities.
• Mentorship: No direct reports; serve as the security technical reference across all teams.

Profile We're Looking For

• Strong interest in AI and its applications in cybersecurity; comfortable leveraging AI tools to improve productivity.
• Master's degree in computer science and/or cybersecurity with 8+ years of experience in software engineering and application/product security, including at least 3 years as a security technical reference for a SaaS or enterprise product.
• Comfortable working in a remote, async-first environment.
• Strong engineering and security skills: fluent production code in at least two of Python, Node.js, TypeScript, Java, or Rust.
• In-depth knowledge of web and API security (GraphQL, OIDC/SAML, RBAC, multi-tenant isolation, SSRF, injection), CI/CD security tooling, and container/Kubernetes security.
• Proven track record of influence without authority: leading cross-team security initiatives and coaching engineers.
• Autonomy, ownership, and team spirit.
• Bonus: AI/LLM security experience (prompt injection, agent permissions), open-source contributions, published CVEs, bug bounty experience, or familiarity with STIX 2.1 / MITRE ATT&CK / OpenCTI / OpenAEV.

What You Can Expect

• Competitive compensation + equity package.
• Remote-first flexibility.
• 25 days PTO baseline.
• Paid volunteer days.
• Equipment stipend / choice of work setup.
• Two annual in-person company and team retreats.