Director of Product Security

Quick Facts

• Role: Director of Product Security
• Location: Mountain View, CA (on-site)
• Reports to: Chief Information Security Officer (CISO)
• Department: Security - Product Security

Description

Product Security keeps one of the most heavily scrutinized identity platforms safe while engineering ships fast. This leadership role owns the Product Security program end-to-end, leads and grows the team, and serves as a trusted security partner to Engineering (not a gatekeeper). The program integrates threat modeling, secure code and architecture review, SCA, secret scanning, vulnerability management, CSPM, and configuration management into the SSDLC as scalable, shift-left, developer-aligned controls.

Responsibilities

• Own the Product Security (ProdSec) program: threat modeling, secure code and architecture review, SCA, secret scanning, vulnerability management, CSPM and configuration management; integrated across the SSDLC as scalable, shift-left, developer-aligned controls
• Lead and grow the security engineering team; accountable for development, growth, and professional well-being
• Define what is and isn’t acceptable security practice for Engineering, with the why, so teams can self-serve
• Provide secure-by-design consulting by partnering with Product and Engineering early at design and architecture time
• Build and maintain security tooling and services that enable engineers to ship secure products at high velocity
• Own penetration testing and Red Team execution and outcomes: scope, findings, and remediation

Requirements

• Outcome-based leadership: translate business objectives into security outcomes; right-size rigor; guide the how without dictating it; deliver without micromanagement
• Accountability for results: measure success by risk reduction and safe engineering work; drive fixes to closure even when another team owns the code
• Partnership with Engineering: make solutions work safely; explain “no” in valuable terms and offer a path; assert security/compliance requirements without dictating product decisions
• Speed and judgment: assessments turn around in days, not weeks; avoid security theater
• Technical depth across threat modeling, code and architecture review, SCA/SAST, secret scanning, vulnerability management, and cloud/CSPM
• Integrity and trust: handle privileged access with discretion; build a team where sharing bad news early is safe and rewarded
• AI fluency: treat AI as a force multiplier and champion AI-augmented security workflows (Claude, Gemini, custom tooling)

Benefits

• Comprehensive medical, dental, vision, and health savings account; flexible spending accounts (medical, limited purpose, dependent care, commuter benefit accounts)
• Basic and voluntary life and AD&D insurance; 401(k) with company match
• Parental leave; unlimited paid time off subject to PTO policy terms and conditions (including 8 company wide holidays)
• Short- and long-term disability insurance; accident and critical illness insurance
• Referral bonus policy; employee assistance program; pet insurance; travel assistant program; wellbeing and childcare discounts; benefit advocates
• Learning and development benefit