Easy Apply
Easy Apply
As a Senior Product Security Engineer, you will ensure product security, manage vulnerabilities, conduct security reviews, and provide guidance to development teams.
At Mattermost, we build the #1 collaborative workflow solution for defense, intelligence, security, and critical infrastructure organizations. Trusted by governments, financial institutions, and technology companies, our platform enables secure, efficient operations for the world’s most critical teams.
We’re dedicated to empowering organizations to operate with confidence, reducing risks, and accelerating productivity. Guided by our core values of Customer Obsession, Earn Trust, Self Awareness, Ownership and High Impact, we collaborate closely with our customers to deliver solutions that meet complex needs and drive success.
To learn more, visit www.mattermost.com
Mattermost is seeking a result-driven and analytical Senior Product Security Engineer to help ensure the security of our product and services across the company. As part of our Security team you will work closely with a globally distributed team to support in all the different aspects of the software development life cycle. You will be responsible for the implementation of additional application security tooling and/or processes across the company and coordinate with relevant stakeholders, gather requirements, and lead the implementation.
Responsibilities Include:
- Support the application vulnerability management and mitigation approaches
- Conduct application security reviews through manual code review or static/dynamic code analysis
- Engage in threat modeling and design reviews of in-house developed software components
- Provide security guidance and training to internal development teams
- Triage SCA findings and support internal development teams in SCA findings remediation
- Improve and/or automate existing processes to increase efficiency.
Requirements:
- BS in Computer Science, Cybersecurity, Software Engineering, or a related technical field, or equivalent experience, with 5+ years of relevant experience
in application security, secure software development, or penetration testing. - Deep understanding of web application security and secure development practices
- Deep understanding with common security libraries, security controls, and common security flaws
- Experience with Threat Modeling applications
- Experience with static/dynamic analysis, and common exploit methods
- Experience in one or more programming languages, ideally Go or Javascript
- Excellent written and verbal communication skills
- Demonstrable teamwork skills and resourcefulness
- For candidates residing in the U.S.: This role may require the ability to obtain and maintain a U.S. government security clearance in the future. As such, U.S. applicants must be U.S. citizens and eligible under applicable clearance requirements.
- Applicants must meet eligibility requirements for access to export-controlled information as defined by U.S. export control laws, including EAR and ITAR.
Preferences:
- Experience working in open source communities
- Experience running a bug bounty program
- Certifications in the domain of penetration testing or application security (e.g. OSCP, OSWE, GWAPT, …)
- Experience with Electron, React or React Native
- Participation in Bug Bounties, CTFs or similar activities
Mattermost takes a market-based approach to pay and pay may vary depending on your location. The successful candidate’s starting pay will be determined based on job-related skills, experience, qualifications, work location, and market conditions. These ranges may be modified in the future.
Salary Range
$135,000—$175,000 USD
Mattermost is an EEO Employer, we are a remote-first, open-source company.
We are continually working to expand our hiring in more countries and regions, ensuring compliance with local laws and regulations, which takes time.
Mattermost values your unique perspective—we welcome all applicants. We encourage individuals from all backgrounds to apply and are committed to assessing candidates based on their skills and qualifications. We do not tolerate discrimination against staff or applicants based on race, religion, national origin, age, disability, pregnancy status, veteran status, or other personal characteristics.
If you require accommodations during the interview process, please let us know—we’re happy to assist.
Top Skills
Application Security Tooling
Dynamic Analysis
Go
JavaScript
Security Libraries
Static Analysis
Similar Jobs
Big Data • Cloud • Software • Database
The Senior Product Security Engineer will enhance MongoDB's security programs, drive complex projects, and ensure the security of product features, collaborating across teams.
Top Skills:
AWSAzureC++GCP
Cloud • Computer Vision • Information Technology • Sales • Security • Cybersecurity
As a Sr. Security Engineer, you will lead threat hunting operations, design monitoring solutions, and enhance product security against potential abuse.
Top Skills:
AWSLogscaleProgramming LanguagesSIEMSplunk
Cloud • Computer Vision • Information Technology • Sales • Security • Cybersecurity
As a Security Engineer, you will design and implement security controls, assess risks, and manage security initiatives across software supply chains to protect CrowdStrike's products and customers.
Top Skills:
Argo CdArtifactoryBitbucketDatadogGitGoJavaScriptJenkinsLinuxLogscalePrometheusPythonRest ApisS3ShellSplunkTlsUnix
What you need to know about the Colorado Tech Scene
With a business-friendly climate and research universities like CU Boulder and Colorado State, Colorado has made a name for itself as a startup ecosystem. The state boasts a skilled workforce and high quality of life thanks to its affordable housing, vibrant cultural scene and unparalleled opportunities for outdoor recreation. Colorado is also home to the National Renewable Energy Laboratory, helping cement its status as a hub for renewable energy innovation.
Key Facts About Colorado Tech
- Number of Tech Workers: 260,000; 8.5% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Lockheed Martin, Century Link, Comcast, BAE Systems, Level 3
- Key Industries: Software, artificial intelligence, aerospace, e-commerce, fintech, healthtech
- Funding Landscape: $4.9 billion in VC funding in 2024 (Pitchbook)
- Notable Investors: Access Venture Partners, Ridgeline Ventures, Techstars, Blackhorn Ventures
- Research Centers and Universities: Colorado School of Mines, University of Colorado Boulder, University of Denver, Colorado State University, Mesa Laboratory, Space Science Institute, National Center for Atmospheric Research, National Renewable Energy Laboratory, Gottlieb Institute
