Software Product Security Engineer

About the role

Datamaze is looking for a Software Product Security Engineer to embed security across the lifecycle of its web-based product, covering design, development, implementation and integration. The role addresses the challenges of delivering the product as an Application as a Service (AaaS) and Software as a Service (SaaS), and works on integrations such as Single Sign-On (SSO) and Identity and Access Management (IAM).

Key responsibilities

• Work with product and engineering teams to design secure architectures for web applications and integrations.
• Evaluate and implement security measures for AaaS and SaaS, including encryption, data protection and tenant isolation.
• Integrate and secure SSO, IAM frameworks and third-party identity providers (e.g. Okta, Azure AD).
• Implement SSL/TLS and secure web headers such as CORS, Content-Security-Policy.
• Identify, prioritize and remediate vulnerabilities manually and automatically.
• Conduct threat modeling and risk assessments.
• Develop secure coding standards and guide engineering teams.
• Build automation scripts for security configuration testing in CI/CD pipelines.
• Monitor and respond to security incidents with security operations.
• Ensure compliance with standards such as SOC 2, ISO 27001 or PCI-DSS and document security policies and configurations.

Required profile

• Bachelor's degree in Computer Science, Cybersecurity, Software Engineering or a related field, or equivalent experience.
• 3-5 years of experience in application security, software development or product security engineering.
• Proven track record securing web-based products in a SaaS or AaaS environment.
• Experience securing product integrations, including APIs and third-party services.
• Strong problem-solving, analytical thinking and communication skills, able to explain security to non-technical stakeholders.

Required skills

• Understanding of AaaS and SaaS security, including multi-tenancy and data segregation.
• SSL/TLS, OAuth, SAML, OpenID Connect; IAM and SSO providers such as Okta or Azure AD.
• CORS, CSRF, XSS and SQL injection mitigation.
• OWASP ZAP, Burp Suite and DevSecOps in CI/CD pipelines.
• Secure coding and encryption standards.
• Scripting in Python, JavaScript or Java.
• AWS, Azure or Google Cloud and their native security tools.