> Markdown version of [/jobs/ext/4018464-staff-appsec-product-security-engineer](https://www.wearedevelopers.com/jobs/ext/4018464-staff-appsec-product-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Staff AppSec / Product Security Engineer

- **Company:** Filigran
- **Location:** France (Remote available)
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Kubernetes Security, Java (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, User Authentication, Software as a Service, Code Review, Cyber Security, Continuous Integration, Python (Programming Language), Node.Js, Open Source Technology, OpenID, Pair Programming, Role-Based Access Control, Microsoft Copilot, Security Assertion Markup Language (SAML), Software Engineering, TypeScript, Software Vulnerability Management, Software Security, Mitre Att&ck, Information Technology, Production Code, Graphql, Static Application Security Testing
- **Published:** October 30, 2026
- **Apply:** https://startup.jobs/staff-appsec-product-security-engineer-filigran-10619263

## About the Role

* Comfortable working with and leveraging AI-powered tools (LLMs, automation, copilots, etc.) to improve workflows and productivity
 * Master degreee in computer science and or cybersecurity with 8+ years of experience in software engineering and application or product security, including at least 3 years as the security technical reference for a SaaS or enterprise product
 * Comfortable working in a remote, async-first environment
 * Strong engineering and security skills: you write production code fluently in at least two of Python, Node.js, TypeScript, Java or Rust, and you know web and API security in depth (GraphQL, OIDC/SAML, RBAC, multi-tenant isolation, SSRF, injection), CI/CD security tooling, and container and Kubernetes security
 * A track record of influence without authority: you led a cross-team security initiative, coached engineers, and got standards adopted with pragmatism and clear priorities
 * Autonomy, ownership, and team spirit
 * Bonus: AI and LLM security (prompt injection, agent permissions), open source contributions or published CVEs, bug bounty program experience, knowledge of STIX 2.1 / MITRE ATT&CK or hands-on use of OpenCTI or OpenAEV

## Description

We're looking for a Staff AppSec / Product Security Engineer to join our Digital Security team, and make security a built-in quality of everything we ship across the XTM platform (OpenCTI, OpenAEV, XTM One, XTM Hub). You'll work closely with the R&D team: the VP, Staff and Principal Engineers, Engineering Managers, Product Owners and the Product Manager. You'll help keep our open source and enterprise products trustworthy for the 6,000+ organizations that defend themselves with them.

This is not a solo audit role. As a Staff engineer, you advise the CISO on product security and turn their strategy into day-to-day practice in the product teams. You lead security as a cross-cutting concern, and coach engineers so they own security in their own scope. And of course, you still code: critical security fixes, PR reviews, pair programming and the shared security components that make the secure path the easy one.

Your Responsibilities

 * Leverage AI tools and methodologies to boost productivity and impact
 * Contribute to building AI capabilities into internal workflows
 * Advise the CISO on product security strategy across the XTM platform, and lead its operational implementation in the product teams: turn priorities into concrete actions, and track security technical pains to resolution.
 * Lead threat modeling and security reviews in feature refinements with Product Owners: authentication and RBAC, multi-tenancy, connectors, the GraphQL API, and AI and agent features.
 * Ensure the security quality of the stack through critical PRs, fixes and code reviews, and build shared, secure-by-default components (authorization, secrets, safe outbound calls, input handling).
 * Drive secure SDLC and supply chain tooling in CI (SAST, SCA, secret and container scanning, Renovate, Snyk, SBOMs, signed releases), tuned so teams trust the results.
 * Run product vulnerability management: intake from the open source community, researchers and bug bounty, coordinated disclosure, CVEs and advisories, remediation SLAs, and the product side of security incidents.
 * Mentor engineers and grow security champions through pairing, workshops and continuous feedback. Document security architecture decisions so they stay consistent across teams.

Who You'll Work With

 * Reports to: the CISO, as part of the Digital Security team.
 * Key collaborators: the R&D team, including Staff and Principal Engineers and Engineering Managers across the product teams, and Product Owners during refinements, Platform Engineering on infrastructure, compliance (SOC 2 Type 2, ISO 27001:2022, FedRamp) and incidents, and Customer Success on customer security questions and pentest findings.
 * Community: the OpenCTI and OpenAEV open source contributors and the security researchers who report vulnerabilities to us.
 * Mentorship: no direct reports. You'll act as the security technical reference and mentor for engineers across all teams, and grow a network of security champions.