Senior or Staff Product Security Engineer

Skylight is a technology startup building products and services designed to simplify family life. The Senior or Staff Product Security Engineer will own day-to-day product security execution across cloud backend, mobile applications, and Android, including vulnerability management, security scanning, bug bounty operations, penetration testing, design reviews, and incident support.

Responsibilities:

• Own the vulnerability management pipeline end to end: intake, triage, prioritization, and driving fixes to closure against defined remediation SLAs across Backend, Mobile, and Android teams
• Join our Platform pod where, with the team, you’ll write and ship security fixes directly in our codebases
• Own and evolve our AI security scanning and verification pipeline. Tune it to reduce false positives, extend coverage to new repositories, and integrate it into CI
• Run our HackerOne bug bounty program: triage reports, validate findings, work with researchers, decide on payouts, and manage the vendor relationship
• Manage third-party penetration testing engagements from scoping through remediation
• Lead security design reviews and threat modeling for new features and products, including AI/LLM-powered features and products that handle children's data
• Review and advise on device and firmware security work led by our firmware team
• Provide metrics and data on findings, remediation, and SLA adherence to support compliance and leadership reporting
• Serve as a subject matter expert during product security incidents

Requirements:

• 6+ years in application or product security, with a software engineering background. You can ship production code, not just review it
• Deep experience securing backend services and APIs, including OAuth 2.0/OIDC, PKCE, MFA, session management, and token handling
• Experience building and maintaining security tooling and automation (static analysis, CI integrations, custom scanners), and comfort working with LLM-based systems
• Hands-on experience running or triaging a bug bounty program
• A track record of getting engineering teams to prioritize and fix security issues through influence and good judgment, not escalation
• Clear written communication and the ability to explain risk to both engineers and non-technical stakeholders
• Mobile application security experience (OWASP MASVS), ideally including shipping fixes in a mobile codebase
• Android platform or app security experience
• Experience assessing AI/LLM features for risks like prompt injection and data leakage
• Familiarity with children's privacy requirements (e.g. COPPA) or other sensitive consumer data
• Exposure to embedded, IoT, or firmware security
• Familiarity with the EU Cyber Resilience Act or UK PSTI
• Incident response experience