Product Security Engineer

Who We Are

We are part of a larger SBG Product Assurance organization whose mission is to Instill confidence in our engineering customers and leaders that SBG offers and products are delivered to the world securely.

What You'll Do

Hands on Security testing: Continually assess the security posture of cloud native applications and Cloud Infrastructures through manual security testing (aka internal pentesting) after Production Deployment

Support Vulnerability Management and Incident Response program run by the Security Operations team to in accordance with the service level agreements set by the customers and Cisco policies

Support third-party Pentest for products: Work with the product engineering to define test scope, validate test findings and engineering fixes, etc. for on-going maintenance of compliance certification

Conduct Product Security Reviews: Work closely with product engineering teams to perform thorough security reviews before the release of various products and features as well as after the production deployment ensuring alignment to security standard methodologies. These security review activities include Threat Modeling, Code Reviews, Software Composition Analysis, Dynamic Application Security Testing, etc.

Collaboration and Communication: Engage with various engineering teams, fostering strong communication and collaboration to drive security initiatives and improvements. Influence product and engineering team to adopt security principles in their workflows and timely remediation of reported security defects pre and post deployment

Process Improvement: Lead efforts to enhance security processes, tools, and standards across the organization, promoting a culture of security awareness and standard methodologies. Optimally scale and mature the SBG product security program by collaborating with key internal partners

Documentation: Maintain comprehensive documentation of security reviews, threat models, testing results, and process improvements until product end of life

Who You Are

Work Experience: Bachelor's degree and a minimum of 6 years of experience in product security, with a proven track record of conducting security reviews and assessments.

Solid foundation of secure Software Development: You have strong competence of secure design, development, and deployment with a variety of tools, technologies, and procedures. Need hands on experience in Threat Modeling, Code Reviews, Software Composition Analysis, Dynamic Application Security Testing, Manual Application Security Testing, etc.

Foundational Skills: Knowledge of Secure Design Principles, Cryptography, Networking, Authentication and Authorization Methods, OWASP, ATT&CK

Coding Skills: Experience in one or more of - Python, Java, JS, JSP

Cloud Security: Experience with securing AWS-based products and infrastructures, with knowledge of cloud security standard methodologies.

DevSecOps and Automation: Familiarity with integrating security practices and tools into DevOps pipelines, promoting a DevSecOps culture.

Strong Communication skills: You love to communicate in a friendly, supportive manner with leaders and engineers alike, helping to not only identify security issues, but also a mentor and advocate on solutions

Building Collaborative Relationships: You can proactively collaborate with internal & customer partners to find opportunities, address ambitious situations, and support customers product security needs. You can influence decision-makers and deliver solutions that work for the customer.

Active Learning and Continuous Improvement: You are curious and can continuously learn about the security market landscape and the current technologies and approaches used to tackle today?s security problems. You can map emerging security technology and principles to solve business needs as applicable.

Good to Have Skills:

Build Environment Security: Experience in securing build environments and ensuring secure development and deployment practices.

Container Technologies: Experience with Docker, K8s, EKS or similar

Security Certifications: Relevant certifications such as CISSP, CEH, OSCP, or equivalent.

Artificial Intelligence: Knowledge of available AI developments and capabilities in the wild and knowledge of using them for productivity or product security

Why Cisco

We connect everything: people, processes, data, and things. We innovate everywhere, taking bold risks to shape the technologies that give us smart cities, connected cars, and handheld hospitals. And we do it in style with unique personalities who aren't afraid to change the way the world works, lives, plays, and learns.

We Are Cisco!


Cisco is an Affirmative Action and Equal Opportunity Employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, gender, sexual orientation, national origin, genetic information, age, disability, veteran status, or any other legally protected basis.

Cisco will consider for employment, on a case by case basis, qualified applicants with arrest and conviction records.