Be an early applicantLess than 25 applicants

Company

Navan · 8 hours ago

Staff Product Security Engineer

United States

Full-time

Remote

Senior Level, Lead/Staff

$150K/yr - $265K/yr

8+ years exp

Maximize your interview chances

Business TravelFinancial Services

H1B Sponsor Likely

Insider Connection @Navan

Discover valuable connections within the company who might provide insights and potential referrals.
Get 3x more responses when you reach out via email instead of LinkedIn.

Responsibilities

Act as the tech lead for high-priority product security initiatives, and ensure timely delivery of impactful initiatives.

Be a key advisor to the overall strategy and roadmap of the Product Security Program.

Drive key initiatives like Supply Chain Security, Authentication, and, Authorization improvements.

Participate in expanding/maturing the Navan S-SDLC program.

Review product designs for security defects, perform threat modeling and recommend remediations.

Work with engineers to identify the tradeoffs of different solutions and recommend the ideal design to meet security requirements.

Design and develop security tools and processes to be leveraged by development teams.

Work closely with engineering to sustain processes and/or convert manual integrations to automated pipeline activities.

Assist in developing custom Security as Code solutions.

Provide training, guidance, and assistance to development teams early in the SSDLC.

Cultivate security ownership in the product teams.

Bring visibility to product/application vulnerabilities in a consistent manner to enable appropriate prioritization and remediation.

Help build the Red Team and PSIRT functions.

Qualification

Find out how your skills align with this job's requirements. If anything seems off, you can easily click on the tags to select or unselect skills to reflect your actual expertise.

Threat modelingApplication security testingCloud environment (AWS)Java Spring FrameworkContinuous integration (Jenkins)Infrastructure as code (Terraform)Security as Code solutionsContainers DockerContainers KubernetesSecurity testing tools integrationDefect tracking (Jira)Source code management (GitHub)Application & network protocolsCompliance requirements knowledgeAgile development experience

Required

Proven experience performing threat modeling and architecture reviews for complex applications.

Proven experience delivering critical org-wide product security initiatives.

Proven experience performing application, cloud and mobile penetration testing in high risk environments like financial or healthcare companies.

8-10 years of Technical Product Security related experience around SSDLC tooling, automation, remediation advisory, security testing, threat modeling/attack surface analysis.

Ability to execute in multifaceted and highly technical organizations.

Ability to provide pragmatic security advice for web applications, mobile applications, and cloud software.

Experience working in Agile development with experience in technologies such as: Cloud environment (AWS, or similar), Application security testing tools (SAST, DAST, IAST, SCA, or similar), Infrastructure as code (Terraform, or similar), Java Spring Framework (3+ years), Hibernate or similar ORM technologies, JavaScript/CSS, and Angular, Containers (Docker, Kubernetes, or similar), Continuous integration (Jenkins, Github Actions or similar), Integration of Security testing tools into CI pipelines, Defect tracking (Jira, or similar), Source code management (GitHub, or similar).

In-depth knowledge of common application & network protocols, cryptographic primitives, authentication & authorization protocols, and common security threats, such as attack techniques, evasive techniques, and preventative & defensive methods.

Deep knowledge of cloud operational models and secure SaaS architecture in a containerized microservices world.

Preferred

Published contributions to the security community.

Deep understanding of browser security and modern JavaScript frameworks.

Knowledge of compliance requirements for industry-standard certifications like PCI DSS, SOC2, HIPAA, and FedRAMP.

Experience working in small teams and delivering outsized impact.

Company

Navan

Glassdoor

3.1

Navan provides travel, expense, and corporate card management to automate manual processes and drive spend visibility.

Founded in 2015

Palo Alto, California, USA

1001-5000 employees

https://navan.com/

H1B Sponsorship

Navan has a track record of offering H1B sponsorships. Please note that this does not guarantee sponsorship for this specific role. Below presents additional info for your reference. (Data Powered by US Department of Labor)

Distribution of Different Job Fields Receiving Sponsorship

Represents job field similar to this job

Trends of Total Sponsorships

2023 (36)