Sr. Product Security Engineer (Remote)

CrowdStrike is a global leader in cybersecurity, dedicated to stopping breaches with an advanced AI-native platform. They are seeking a Senior Product Security Engineer to identify design and implementation flaws in their endpoint products and collaborate with product engineers to enhance security and ship secure code.

Responsibilities:

• Join project teams working on product improvements and new products as a security expert and advisor, influencing the design and capabilities of our world-class endpoint protection products, with a focus on the endpoint sensors
• Create and update threat models to help drive security decisions
• Read and review source code for applications, looking for security flaws and vulnerabilities; you’ll have tools to help you but you’ll be digging deeper than tools can
• Think like a hacker and attack endpoint applications with kernel components, mostly before they go to production; again, you’ll have tools to help you, but you’ll do more than tools can
• Work with developers to help them understand problems, risks, design weaknesses, etc. and figure out good solutions
• Build tools and automation to make your life/your team’s life/developers’ lives easier
• Validate and replicate some kinds of bug bounty reports, and hunt for similar issues in affected applications

Requirements:

• 10+ years of experience in engineering, ideally in security
• Experience programming in or assessing security of C/C++ apps for Linux
• Proficiency of system internals and security features for Linux
• Comfort with concurrency considerations in multi-threaded applications
• Understand the security implications of containerization and virtualization
• A working understanding of how software products are created and shipped in Agile/DevOps like environments – enough to have a positive working relationship with product engineers (software product development experience is a huge plus, but not a requirement)
• A solid understanding of common software weaknesses that impact endpoint and client/server applications; you'll be hunting for these, you need to know them when you see them and be able to help product engineers understand and fix them
• Comfort with collaborating across technical teams: asking technical questions, challenging assumptions, getting or providing context for decisions, etc
• Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes
• Rust & Go programming
• Experience with debuggers like Ghidra, IDA Pro, or other similar tools
• Experience developing/maintaining automation for application security tasks
• Experience developing and using threat models, especially using STRIDE
• Application penetration testing experience, especially if it includes testing against install packages and control bypass methods
• Reverse-engineering or malware analysis, or related security research capabilities