Product Security Engineer II

Responsibilities

• Triage and prioritize vulnerability reports from Snyk, Dependabot, container scanning, Nessus, security teams, researchers, and testing firms using CVSS 3.1/4.0.
• Coordinate internal and external penetration testing, reproduce and validate findings, verify fixes, and support coordinated vulnerability disclosure with PSIRT.
• Lead security reviews for product releases and collect the evidence and artifacts required for release approval.
• Maintain risk assessments, threat models, security documentation, customer security information, and SBOMs for released products.
• Review designs and Java/Spring and TypeScript code for authentication, authorization, SSRF, XXE, path traversal, session management, logging, and secrets-management vulnerabilities.
• Guide or implement remediation, develop negative security tests, and define security-hardening requirements for appliances and customer-managed Linux environments.
• Partner with DevOps on security scanning in build pipelines and support release and package signing.

Requirements

• 7+ years of experience in software engineering or cybersecurity, including 3+ years in product or application security.
• Ability to review Java/Spring, TypeScript, and Linux configurations to investigate and validate security findings.
• Hands-on experience with SCA and vulnerability scanning tools, CVSS, CWE, and OWASP Top 10.
• Working knowledge of IEC 62443-4-1/4-2, NIST SSDF, or comparable secure development standards.
• Knowledge of applied cryptography, FIPS 140-3 modes, PKI/TLS, LDAP, SAML, OAuth2, container/Kubernetes security, and SBOM formats such as CycloneDX or SPDX.
• Experience triaging externally reported vulnerabilities and supporting coordinated vulnerability disclosure.
• Strong communication skills with developers, product managers, Legal, customers, security researchers, and external testing organizations.
• Preferred: experience with cybersecurity legislation such as the EU Cyber Resilience Act and with penetration-testing or external security-testing programs such as CyTRICS.
• Preferred: ability to implement security fixes in Java/Spring or TypeScript and experience using AI-assisted tools for secure code review or vulnerability discovery.
• Preferred: relevant security certification such as GIAC GWEB, OSWE, CKS, or CSSLP.

Benefits

• Expected U.S. pay range is USD 117,600–176,400 per year, including base pay and short-term incentives.
• Benefits include medical, dental, vision, basic life insurance, flexible work arrangements, paid family leave, well-being programs, 12 holidays, and 15 days of paid time off per year.
• Future-planning benefits include company share ownership and a 401(k) with match.
• Professional development includes performance discussions, global opportunities, the Schneider Career Hub, and Coursera learning platforms.
• Additional support includes volunteer leave, Schneider Electric Foundation programs, youth education initiatives, military leave benefits, and an inclusive workplace.