Note: The job is a remote job and is open to candidates in USA. ServiceTitan is hiring a Staff Product Security Engineer to own security outcomes across a defined engineering portfolio, spanning application and cloud security. The role partners with engineering leaders on planning, threat modeling, architecture, risk prioritization, secure-by-default adoption, remediation, champion coaching, and incident support.
Responsibilities
- Join the portfolio's planning and design cadences as a permanent participant. Review roadmaps, architecture proposals, and technical designs early enough to shape them rather than gate them
- Lead and scale threat modeling across the portfolio using the program's standard and tooling. Prioritize top-tier systems, coach squads to run their own models, and make sure identified threats become tracked requirements in the findings flow
- Provide secure architecture guidance for cloud-native services, microservices, multi-tenant data access, identity and secrets handling, and AI-enabled features. Translate the program's security requirements into concrete design decisions the squads can implement
- Maintain a current, evidence-backed view of the portfolio's security risk across application findings, cloud posture, identity, and data exposure. Know what each squad builds, the data it touches, and where it is heading
- Partner directly with the portfolio VP and their leaders to set remediation priorities, negotiate tradeoffs, and drive adherence to vulnerability remediation SLAs. Bring the data, own the follow through, and escalate with judgment
- Guide squads through the program's risk acceptance process. Make sure exceptions are documented, time-bound, and visible to the right decision makers
- Take the paved roads built by the Platform and Programs team, including secure service templates, secrets management patterns, secure cloud configuration templates, CI/CD guardrails, and IaC policy sets, and adapt them to each squad's stack and workflow
- Get squads onto SAST, SCA, secrets scanning, IaC scanning, container scanning, and CSPM coverage, and keep them there. Tune signal quality with squads so findings are actionable, and close the loop on what is noise versus real risk
- Read the code, review the Terraform, and pair with engineers on fixes for the hard findings. Write reference implementations and fixes when that is the fastest way to unblock a squad
- Recruit, coach, and support the security champions across your squads. Be the technical expert they bring the hard questions to, and build them into the portfolio's first line of security response
- Deliver just-in-time training, design reviews, and office hours tuned to what the portfolio is actually building. Help squads learn to fix their own code and configuration
- Bring real engineering context back to the Director and the Platform and Programs team. Identify where central tooling, patterns, or standards fall short of what squads need, and shape what gets built next
- Contribute portfolio-level data to the program's metrics rhythm. Report on coverage, remediation velocity, and risk trends for your portfolio to security and engineering leadership
- Support triage and investigation of security incidents touching your portfolio, and turn lessons learned into design changes and paved-road improvements
Skills
- 7-10+ years in product security, application security, cloud security, or a closely related security engineering role, with a strong software engineering foundation
- Demonstrated ability to work across the full stack of a modern SaaS product: secure code review, threat modeling, secure design, CI/CD and supply chain security, cloud identity and least privilege, IaC security, container and Kubernetes security, and cloud posture management
- Proficiency reading and writing code in C#/.NET, Go, Java, or Python, and hands-on experience with Azure and/or AWS security services and IaC tooling such as Terraform or Bicep
- Track record of leading threat modeling and architecture review at scale, and of turning the results into requirements engineering teams actually deliver
- Proven ability to build trust with VP level engineering leaders and senior engineers, drive priorities through partnership rather than mandate, and hold the line on risk when it matters
- Preference for building repeatable patterns over one-off fixes
- Comfortable scripting and automating security tasks, and comfortable using AI-assisted tooling to scale your own work
- Familiarity with securing AI-enabled features and AI coding agents, and with the emerging risks around non-human identities, MCP integrations, and data exposure in AI systems
- Prior experience embedded with or partnering directly with engineering teams
- C#/.NET
- CISSP, CCSP, CSSLP, AWS Security Specialty, Azure Security Engineer, OSCP, or similar are a plus, not a requirement
Benefits
- Flexible time off
- Ample learning and development opportunities
- Comprehensive onboarding program
- Leadership training for Titans at all levels
- Other programs and events
- Bonusly
- Peer-nominated awards
- Company-paid medical, dental, and vision (with 100% employer paid options and 90% coverage for dependents)
- FSA and HSA
- 401k match
- Telehealth options including memberships to One Medical
- Parental leave and support
- Up to $20k in fertility services (i.e. IUI and IVF)
- Surrogacy and adoption reimbursement
- On demand maternity support through Maven Maternity
- Free breast milk shipping through Maven Milk
- Pet insurance
- Legal advisory services
- Financial planning tools
- Annual bonus
- Equity
Company Overview
Company H1B Sponsorship