Principal Product Security Engineer
2 weeks ago
As a Principal Product Security Engineer at Vimeo, you will engage in a variety of activities, either offensive, defensive, or some combination thereof, ultimately aimed at safeguarding our users who entrust Vimeo with their content every day.
You’ll plan, carry out, and lead security initiatives to monitor and protect sensitive data and systems from infiltration and cyber-attacks.
You will likely collaborate frequently with and support developers, as well as members of the infrastructure security team, the compliance team, IT, Product, and other teams throughout the organization.
You love to solve puzzles, and are a great team player.
This role is remote.
What you’ll do:
The primary emphasis of this role will be code, both reading and writing it (securely) and chatting about it with developers.
You will dive deep into the Vimeo codebase and become highly familiar with many of our repos. You will form and communicate strong opinions about the security, maintainability, and overall quality of existing and proposed architectures, at both the software and system level. You will frequently consult with developers and product managers, providing them with valuable guidance on secure coding patterns and system architectures.
During a typical week, you may spend some time:
Tracking down the line of code responsible for a bug discovered via our bug bounty program ( and then educating developers and providing them with recommendations on how to best fix the issue Auditing a legacy backend controller and providing recommendations to developers on how to best refactor the code to eliminate existing authorization bugs and reduce the likelihood of future ones Paring with an engineering team to design the architecture for a new microservice and ensuring that the design adheres to industry best practices (e.g. OWASP ASVS 4.0, CIS benchmarks, etc.) Coding up a prototype for a new permissions middleware Flagging to leadership a recurring systemic security issues in our codebase and providing highly actionable recommendations to address the root cause in a thorough, maintainable manner Hopping on a call or two with Development, Product Management teams to discuss security-related issues Engaging with one or more product development teams and guide them through a threat model and data flow analysis. Providing technical advice in response to occasional questions from developers and other members of the security teamAs such, you must be highly proficient with both reading and writing high quality, highly maintainable full-stack web application code, including front-end, back-end, and infrastructure components. You must be comfortable regularly communicating with a broad variety of stakeholders.
Depending on your preferences and the current needs of the team, you may potentially also participate in the following activities (although, this will likely be secondary to the activities described above):
Penetration testing — either hunt for security issues on our production or staged applications during an open-box internal pen test, or help coordinate an engagement with an external firm Writing code for internal automated security tools — write some code, usually in Python, Bash, or Go, to support any of our team's various initiatives. Often we strive to facilitate a culture of “paved roads” for our developers, such that it is easy for any developer to incorporate security into their designs and implementations Threat modeling — consider how malicious attackers may compromise our systems, and advise developers and product managers on what defenses are needed Code reviews — discover weakness in our source code before it reaches production Bug bounty program — help triage new incoming reports on a daily basis, plus launch creative initiatives to increase researcher engagement on our programs Web Application Firewall and Rate Limiting — expand coverage and tune new rules while coordinating with developers, support team members, and the site reliability team Remediation — enable and encourage developers to correctly fix recently discovered security issues in a timely manner, ultimately reducing our Mean Time To Remediate Secure Software Development Lifecycle — configure automated tooling (eg. static and dynamic code analysis, IAST) in our SDLC to detect security issues in our source code before it reaches production Developer Education, Security Culture — create fun ways to spread technical security awareness throughout the engineering department Incident response — lead or assist in running the various phases of an incident response, including initial detection, triage, containment, recovery, root cause analysis, retrospective, etc. Collaboration with the infrastructure security team — pair with members of the infrastructure security team on various projects to secure our cloud instances and employee workstations Collaboration with the compliance and privacy team — help ensure that our company complies with industry best practices and standards Process improvements — help strengthen our own internal processes and proceduresSkills and knowledge you should possess:
Required: 5+ years of prior experience in either software development, devops, or site reliability engineering with hands-on coding experience. Preferred: prior experience in Application Security 7+ total years of relevant experience in Engineering, Application Security, or a similar technical field. Strong knowledge of modern web, mobile, and network security Strong programming skills with at least one of the following languages, and the ability to read all of them: Python, Go, PHP, Javascript, and Ruby Expertise with application pen testing, using tools like Burp or Zap Confident working in and across cloud environments like AWS and GCP. Detailed knowledge of at least one cloud environment. Confident with shell scripting Confident with common SDLC components, like git, Jira, Jenkins, etc Confident ability to communicate technical security concepts to developers At least an upper-intermediate level of EnglishBonus points (nice skills to have, but not needed):
Link to a Github repo with security tools/scripts you’ve developed or help maintain Full-stack web development experience creating RESTful applications (in any language) is a big plus Open source vulnerability research or blog posts is a big plus Experience with system security hardening guidelines and SDLC principlesAbout Us:
Vimeo (NASDAQ: VMEO) is the world's most innovative video experience platform. We enable anyone to create high-quality video experiences to better connect and bring ideas to life. We proudly serve our community of millions of users – from creative storytellers to globally distributed teams at the world's largest companies – whose videos receive billions of views each month. Learn more at Vimeo is headquartered in New York City with offices around the world. At Vimeo, we believe our impact is greatest when our workforce of passionate, dedicated people, represents our diverse and global community. We’re proud to be an equal opportunity employer where diversity, equity, and inclusion is championed in how we build our products, develop our leaders, and strengthen our culture.-
Principal Security Engineer
5 days ago
bangalore, India HERE Technologies Full timeWhat's the role? Key Functions: Lead a team of 2 SOC analysts/engineers covering the APAC region for a follow-the-sun SOC Operations. Oversee and actively participate in Detection/Monitoring activities, continuously monitoring network traffic and security alerts for potential threats and vulnerabilities. Develop and implement robust...
-
Principal Software Engineer
5 days ago
Bangalore, India New Relic, Inc. Full timePrincipal Software Engineer - Security Products Principal Software Engineer - Security Products Principal Software Engineer Req ID FY|R&D|#5 Location(s) Bangalore, India; Hyderabad, India; Work arrangement(s) Hybrid (works from home and New Relic office throughout the week) Your opportunity Interested in helping developers around the world improve the...
-
Principal Software Engineer
5 days ago
bangalore, India New Relic, Inc. Full timePrincipal Software Engineer - Security Products Principal Software Engineer - Security Products Principal Software Engineer Req ID FY|R&D|#5 Location(s) Bangalore, India; Hyderabad, India; Work arrangement(s) Hybrid (works from home and New Relic office throughout the week) Your opportunity Interested in helping developers around the world improve the...
-
Netwitness-Software Principal Engineer
2 weeks ago
bangalore, India RSA Security Full timeNetwitness-Software Principal Engineer As one of the most established cybersecurity companies in the world, we at NetWitness are hard at work every day helping our customers and partners better protect their organizations from cyberattacks. Our products and incident response services are used within most large enterprises, governments and militaries...
-
Netwitness Product Senior Security Engineer
2 weeks ago
bangalore, India RSA Security Full timeResponsibilities• Work on any number of security and identity related areas and products• Build systems for detecting anomalous activities within the product• Develops and administers software engineering procedures and training for vulnerability scans and static code analysis• Analyse vulnerability report of various SCA and SAST scan tools like,...
-
Principal Engineer, Platform Security
4 weeks ago
bangalore, India Spectrum Consultants India Private Limited Full timePrincipal Engineer, Platform Security Summary Experience Required: 15 - 20 YearsJob Term: PermanentLocation: BangaloreCategory: Software DevelopmentWorld's largest and highest valued semiconductor chip makersIn this hands-on leadership position, you will formulate and execute plans for security research for various aspects of platforms and its...
-
bangalore, India RSA Security Full timeRSA is the premier provider of security, risk and compliance management solutions for business acceleration. RSA helps the world's leading organizations solve their most complex and sensitive security challenges. These challenges include managing organizational risk, safeguarding mobile access and collaboration, proving compliance, and securing virtual and...
-
Principal Engineer Network Security
3 days ago
bangalore, India News Corp Full timeJob Description : We are seeking a highly skilled Principal Engineer specializing in Network Security to join our dynamic team. As a Principal Engineer, you will play a pivotal role in designing, implementing, and maintaining our network security infrastructure. You will collaborate with cross-functional teams to develop innovative solutions that...
-
Netwitness - Software Senior Engineer
2 weeks ago
bangalore, India RSA Security Full timeJob Title : Principal Software Engineer - Platform Engineering Location : Bangalore Job Type : Full-Time Job Description : We are seeking a highly skilled and experienced Principal Software Engineer to join our Platform Engineering team. As a Principal Software Engineer, will play a critical role in shaping the technical direction of our...
-
Principal Security Program Manager
2 months ago
bangalore, India Informatica Full timeExternal Description: Build Your Career at Informatica We're looking for a diverse group of collaborators who believe data has the power to improve society. Adventurous, work-from-anywhere minds who value solving some of the world's most challenging problems. Here, employees are encouraged to push their boldest ideas forward, united by a passion to...
-
RSA - Application Security Engineer
2 weeks ago
bangalore, India RSA Security Full timeRSA - Application Security Engineer Location: Remote India RSA offers mission-driven security solutions that provide organizations with a unified approach to managing digital risk that hinges on integrated visibility, automated insights and coordinated actions. RSA solutions are designed to effectively detect and respond to advanced attacks;...
-
Principal Engineer.
1 week ago
bangalore, India Cisco Full timeWho We Are The Cisco Security AI team delivers AI products and platform for all Cisco secure products and portfolios so businesses around the world can defend against threats and safeguard the most vital aspects of their business with security resilience. We are passionate about making businesses secure and simplifying security with zero compromise using...
-
Principal Application Security Engineer
2 weeks ago
bangalore, India Livestream Full timePrincipal Application Security Engineer As a Principal Application Security Engineer at Vimeo, you will engage in a variety of activities, either offensive, defensive, or some combination thereof, ultimately aimed at safeguarding our users who entrust Vimeo with their content every day. You’ll plan, carry out, and lead security initiatives...
-
Software Principal Engineer
5 days ago
bangalore, India Dell International Services India Pvt Ltd (7451) Full timeSoftware Principal Engineer The Software Engineering team delivers next-generation software application enhancements and new products for a changing world. Working at the cutting edge, we design and develop software for platforms, peripherals, applications and diagnostics — all with the most advanced technologies, tools, software engineering...
-
Principal Software Engineer
5 days ago
bangalore, India Palo Alto Networks Full timeCompany Description Our Mission At Palo Alto Networks everything starts and ends with our mission: Being the cybersecurity partner of choice, protecting our digital way of life. Our vision is a world where each day is safer and more secure than the one before. We are a company built on the foundation of challenging and disrupting the way...
-
Netwitness Product Operations Sr Engineer
2 weeks ago
bangalore, India RSA Security Full timeThe RSA NetWitness Platform provides pervasive visibility across a modern IT infrastructure, enabling better and faster detection of security incidents, with full automation and orchestration capabilities to investigate and respond efficiently. RSA NetWitness Platform takes security “beyond SIEM,” extending the traditional log-centric,...
-
Principal Application Security Engineer
2 weeks ago
bangalore, India Vimeo, Inc. Full timePrincipal Application Security Engineer You’ll plan, carry out, and lead security initiatives to monitor and protect sensitive data and systems from infiltration and cyber-attacks. You love to solve puzzles, and are a great team player. This role is remote. The expected hours are: Summer months (second Sunday in March thru first...
-
Software Senior Principal Engineer
1 day ago
bangalore, India Dell International Services India Pvt Ltd (7451) Full timeSoftware Senior Principal Engineer The Software Engineering team delivers next-generation application enhancements and new products for a changing world. Working at the cutting edge, we design and develop software for platforms, peripherals, applications and diagnostics — all with the most advanced technologies, tools, software engineering...
-
Principal Software Engineer
5 days ago
bangalore, India DigiCert Full timeABOUT DIGICERT We're a leading, global security authority that's disrupting our own category. Our encryption is trusted by the major ecommerce brands, the world's largest companies, the major cloud providers, entire country financial systems, entire internets of things and even down to the little things like surgically embedded pacemakers. We help...
-
Principal Product Manager-Lead
2 weeks ago
bangalore, India Microsoft Full timeOverview We are looking for a Principal Product Manager to join our team. Microsoft Purview Data Security, Governance and Compliance team is looking for an experienced, energetic and hands on Product Management leader to drive product strategy for its data connector and scanning platform. Our team charter is to provide the foundation to enable...
