# Product Security Engineer

[Silverfort](https://gurify.com/jobs?q=Silverfort) · Tel Aviv-Yafo, Israel · Posted today

[Security](https://gurify.com/jobs/security)

[Apply on the original posting → (opens in a new tab)](https://www.comeet.com/jobs/silverfort/54.007/product-security-engineer/43.471)

## Job description

Silverfort is on a mission to bring identity security everywhere – to every human, machine, and AI agent, both on-premises and in the cloud.

Our unique technology secures identities and access at runtime, in ways that weren’t possible before. With the broadest identity security platform in the market, trusted by more than 1,000 customers, including many Fortune 100 companies, Silverfort is uniquely positioned to lead the fast-growing identity security category.

Joining Silverfort means becoming part of a fast-moving team with a culture of innovation and collaboration that goes above and beyond to help our customers and each other on a journey to reshape the future of identity security.

We are looking for a Senior Product Security Engineer to join us and own product security across Silverfort’s engineering organization. In this role, you will embed security into the software development lifecycle, partner closely with R&D as an enabler, and build the programs, tooling, and culture that make security a first-class part of how we build.

### Responsibilities

- Lead threat modeling across products, features, and architecture changes, and turn findings into actionable security requirements

- Own product security tooling end-to-end - SAST, DAST, SCA, and secrets scanning - from selection and integration to tuning, triage, and remediation

- Run hands-on security code and design reviews, finding real vulnerabilities before they ship

- Partner with R&D to secure new AI/ML features, covering prompt injection, data exposure, and model misuse

- Build security guardrails and secure coding guidelines that make the secure path the easy path for R&D teams

- Own vulnerability intake and CVE handling - responsible disclosure, triage, remediation, and CVE issuance - and coordinate external penetration tests through to closure

- Launch and run the bug bounty program: platform selection, scope, rewards, and researcher relationships

- Drive supply chain and CI/CD security: pipeline hardening, secrets management, SBOM generation, and dependency risk

### Requirements

- 5+ years of hands-on experience in application or product security at a software company or security vendor

- Deep knowledge of OWASP Top 10 and web, API, and cloud vulnerability classes, plus cryptography fundamentals (key management, TLS, hashing), with the ability to validate vulnerabilities in real code

- Hands-on experience with SAST (Semgrep, Checkmarx, or similar), DAST (Burp Suite, OWASP ZAP), and SCA (Snyk, Dependabot, or Black Duck)

- Practical threat modeling experience, with a track record of making it useful for engineering teams

- Strong understanding of OAuth 2.0, OIDC, SAML, and JWT, and the security implications of each

- Cloud-native security across AWS or Azure - workloads, containers, serverless, and IaC (Terraform) - and CI/CD pipeline security, including security gates and secrets management (Vault, AWS Secrets Manager, or similar)

- Python or Bash scripting for building security tooling and automating findings workflows

- Hands-on use of AI coding and reasoning tools (Claude, ChatGPT, Copilot, Cursor, and similar) in real production work - using them to ship faster and to higher quality, not just to experiment

- Clear communication and the ability to drive remediation across engineering teams

### Advantages:

- CVE research, bug bounty hunting, or a track record of responsible disclosure

- Offensive security background - OSCP, CTF experience, or penetration testing certifications

- Depth in identity protocols: token flows, delegated trust patterns, and identity-related attack vectors

- Experience securing AI/ML features or pipelines

**Live in Silverfort’s hiring system.** Read from the company's own applicant tracking system, not reposted from a job board — so it's a real, open requisition rather than an ad that outlived the role.

We remove it as soon as it disappears at source.

## More jobs like this

- NE [Principal Application Security Engineer/Architect](https://gurify.com/job/principal-application-security-engineer-architect-at-nextta-73633c565345) Nextta · Tel Aviv, Israel · last week
- TE [Charm Security- Senior Backend Engineer – Platform](https://gurify.com/job/charm-security-senior-backend-engineer-platform-at-team8-02db73e71c38) Team8 · Tel Aviv-Yafo, Israel · 2 weeks ago
- CN [Product Manager – Data Security](https://gurify.com/job/product-manager-data-security-at-cato-networks-5cd3a89da50d) Cato Networks · Tel Aviv District, Israel · 3 weeks ago
- GU [Technical Product Manager - Security](https://gurify.com/job/technical-product-manager-security-at-guardio-860403bc546c) Guardio · Tel Aviv-Yafo, Israel · 4 weeks ago
- UP [Technical Support Engineer](https://gurify.com/job/technical-support-engineer-at-upwind-1e5908c5aee0) Upwind · Ramat Gan, Israel · 6 days ago
- WI [Security Operations Specialist - Careers - Wiz](https://gurify.com/job/security-operations-specialist-careers-wiz-at-wizinc-0c7d941fe75a) Wizinc · Tel Aviv · 3 days ago

```json
{"@context":"https://schema.org/","@type":"JobPosting","title":"Product Security Engineer","description":"\u003Cp\u003ESilverfort is on a mission to bring identity security everywhere \u2013 to every human, machine, and AI agent, both on-premises and in the cloud.\u003C/p\u003E\u003Cp\u003EOur unique technology secures identities and access at runtime, in ways that weren\u2019t possible before. With the broadest identity security platform in the market, trusted by more than 1,000 customers, including many Fortune 100 companies, Silverfort is uniquely positioned to lead the fast-growing identity security category.\u003C/p\u003E\u003Cp\u003EJoining Silverfort means becoming part of a fast-moving team with a culture of innovation and collaboration that goes above and beyond to help our customers and each other on a journey to reshape the future of identity security.\u003C/p\u003E\u003Cp\u003EWe are looking for a Senior Product Security Engineer to join us and own product security across Silverfort\u2019s engineering organization. In this role, you will embed security into the software development lifecycle, partner closely with R\u0026amp;D as an enabler, and build the programs, tooling, and culture that make security a first-class part of how we build.\u003C/p\u003E\u003Ch3\u003EResponsibilities\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003ELead threat modeling across products, features, and architecture changes, and turn findings into actionable security requirements\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EOwn product security tooling end-to-end - SAST, DAST, SCA, and secrets scanning - from selection and integration to tuning, triage, and remediation\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ERun hands-on security code and design reviews, finding real vulnerabilities before they ship\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EPartner with R\u0026amp;D to secure new AI/ML features, covering prompt injection, data exposure, and model misuse\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EBuild security guardrails and secure coding guidelines that make the secure path the easy path for R\u0026amp;D teams\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EOwn vulnerability intake and CVE handling - responsible disclosure, triage, remediation, and CVE issuance - and coordinate external penetration tests through to closure\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ELaunch and run the bug bounty program: platform selection, scope, rewards, and researcher relationships\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EDrive supply chain and CI/CD security: pipeline hardening, secrets management, SBOM generation, and dependency risk\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003ERequirements\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003E5\u002B years of hands-on experience in application or product security at a software company or security vendor\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EDeep knowledge of OWASP Top 10 and web, API, and cloud vulnerability classes, plus cryptography fundamentals (key management, TLS, hashing), with the ability to validate vulnerabilities in real code\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EHands-on experience with SAST (Semgrep, Checkmarx, or similar), DAST (Burp Suite, OWASP ZAP), and SCA (Snyk, Dependabot, or Black Duck)\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EPractical threat modeling experience, with a track record of making it useful for engineering teams\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EStrong understanding of OAuth 2.0, OIDC, SAML, and JWT, and the security implications of each\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ECloud-native security across AWS or Azure - workloads, containers, serverless, and IaC (Terraform) - and CI/CD pipeline security, including security gates and secrets management (Vault, AWS Secrets Manager, or similar)\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EPython or Bash scripting for building security tooling and automating findings workflows\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EHands-on use of AI coding and reasoning tools (Claude, ChatGPT, Copilot, Cursor, and similar) in real production work - using them to ship faster and to higher quality, not just to experiment\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EClear communication and the ability to drive remediation across engineering teams\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EAdvantages:\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003ECVE research, bug bounty hunting, or a track record of responsible disclosure\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EOffensive security background - OSCP, CTF experience, or penetration testing certifications\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EDepth in identity protocols: token flows, delegated trust patterns, and identity-related attack vectors\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExperience securing AI/ML features or pipelines\u003C/li\u003E\u003C/ul\u003E","identifier":{"@type":"PropertyValue","name":"Gurify","value":"product-security-engineer-at-silverfort-ab7ac11fa949"},"url":"https://gurify.com/job/product-security-engineer-at-silverfort-ab7ac11fa949","datePosted":"2026-11-04","validThrough":"2026-12-19T23:59:59Z","hiringOrganization":{"@type":"Organization","name":"Silverfort","sameAs":"https://www.comeet.com/jobs/silverfort"},"directApply":false,"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressCountry":"IL","addressLocality":"Tel Aviv-Yafo"}}}
```

```json
{"@context":"https://schema.org/","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Jobs","item":"https://gurify.com/jobs"},{"@type":"ListItem","position":2,"name":"Israel","item":"https://gurify.com/jobs/israel"},{"@type":"ListItem","position":3,"name":"Product Security Engineer","item":"https://gurify.com/job/product-security-engineer-at-silverfort-ab7ac11fa949"}]}
```