Staff AppSec / Product Security Engineer

🌀 The Company Founded in 2022, Filigran is a global cybersecurity company on a mission to empower defense teams to be proactive through open-source solutions that uncover threats and drive action. Filigran stands out in the cybersecurity ecosystem through its open-source, AI-powered and threat-informed approach to Continuous Threat Exposure Management (CTEM). Our eXtended Threat Management (XTM) platform brings together threat intelligence, exposure validation and cyber risk reduction, enabling organizations to better understand their threat landscape and take action. At the heart of Filigran is our open-source approach. Our vision is to unite defenders into a global community to make security more open, resilient and collaborative. As Filigran continues to scale globally, we are building the organization, infrastructure and capabilities needed for our next stage of growth. How we scale matters just as much as how fast we scale: our CORE values: Cohesion, Openness, Responsibility and Equity shape how we work together, make decisions and build for the future.   🎯 The Role We're looking for a Staff AppSec / Product Security Engineer to join our Digital Security team, and make security a built-in quality of everything we ship across the XTM platform (OpenCTI, OpenAEV, XTM One, XTM Hub). You'll work closely with the R&D team: the VP, Staff and Principal Engineers, Engineering Managers, Product Owners and the Product Manager. You'll help keep our open source and enterprise products trustworthy for the 6,000+ organizations that defend themselves with them. This is not a solo audit role. As a Staff engineer, you advise the CISO on product security and turn their strategy into day-to-day practice in the product teams. You lead security as a cross-cutting concern, and coach engineers so they own security in their own scope. And of course, you still code: critical security fixes, PR reviews, pair programming and the shared security components that make the secure path the easy one. 💼 Your Responsibilities • Leverage AI tools and methodologies to boost productivity and impact • Contribute to building AI capabilities into internal workflows • Advise the CISO on product security strategy across the XTM platform, and lead its operational implementation in the product teams: turn priorities into concrete actions, and track security technical pains to resolution. • Lead threat modeling and security reviews in feature refinements with Product Owners: authentication and RBAC, multi-tenancy, connectors, the GraphQL API, and AI and agent features. • Ensure the security quality of the stack through critical PRs, fixes and code reviews, and build shared, secure-by-default components (authorization, secrets, safe outbound calls, input handling). • Drive secure SDLC and supply chain tooling in CI (SAST, SCA, secret and container scanning, Renovate, Snyk, SBOMs, signed releases), tuned so teams trust the results. • Run product vulnerability management: intake from the open source community, researchers and bug bounty, coordinated disclosure, CVEs and advisories, remediation SLAs, and the product side of security incidents. • Mentor engineers and grow security champions through pairing, workshops and continuous feedback. Document security architecture decisions so they stay consistent across teams. 🤝 Who You’ll Work With • Reports to: the CISO, as part of the Digital Security team. • Key collaborators: the R&D team, including Staff and Principal Engineers and Engineering Managers across the product teams, and Product Owners during refinements, Platform Engineering on infrastructure, compliance (SOC 2 Type 2, ISO 27001:2022, FedRamp) and incidents, and Customer Success on customer security questions and pentest findings. • Community: the O