Product Security Engineer

Role Overview

ID.me is looking for a Product Security Engineer to join our Product Security organization as an execution-focused individual contributor. If you love deep technical work, building security solutions, and solving complex security challenges, here's your chance to make a career of it by advancing the digital identity ecosystem while protecting millions of users. As one of the most targeted identity platforms in the country, ID.me safeguards a massive volume of sensitive PIImaking Product Security the tip of the spear in defending against sophisticated adversaries and ensuring our products remain resilient at scale.

We are seeking a highly skilled security engineer who excels at implementing and fixing security issues across software and cloud, building automation, and executing complex technical projects. As a Product Security Engineer, you will be a technical expert who delivers production-ready technology solutions, solves the hardest problems, and performs deep technical security assessments that directly strengthen the security of our products. Your work will shape the defensive foundation of a platform relied upon nationwide, giving you the opportunity to make a meaningful, visible impact on the safety and trust of millions of users.

This role is based out of our Mountain View, CA or McLean, VA offices and requires full-time in-office attendance.

What You'll Do

• Implement complex security solutions, including Cloud and SaaS security, and service account protections, and Application Security.
• Build production-ready security automation using Python or Java to scale security operations and reduce manual toil
• Execute security projects from requirements through deployment with minimal guidance, delivering high-quality results on time
• Troubleshoot complex security issues in production environments, conducting deep technical analysis and implementing fixes quickly
• Implement GKE security controls
• Build and maintain cloud security infrastructure using Terraform
• Configure GCP security services such as VPC Service Controls, Private Service Connect, Cloud Armor policies, IAM roles, and Secret Manager
• Execute API security assessments by conducting security reviews, identifying vulnerabilities, and implementing remediation
• Execute vulnerability remediation workflows for application, container, Cloud, and SaaS vulnerabilities within defined SLAs
• Build security dashboards and reporting to track vulnerability MTTR, security control effectiveness, and false positive rates
  
  

Basic Qualifications

• 5+ years in security and/or software engineering, with focus on implementation and execution
• 5+ years of hands-on programming in Python or Java with demonstrated ability to build production-quality security tooling and automation
• 3+ years of hands-on GCP experience including GKE, Cloud Run, IAM, Secret Manager, and security services
• Container / mesh networks (GKE, Docker, Kubernetes security, image scanning, Binary Authorization, SBOM)
• Infrastructure-as-code proficiency (Terraform preferred) for deploying and maintaining security infrastructure
• Troubleshooting expertise with ability to debug complex issues in production cloud environments

Preferred Qualifications

• GCP Professional Cloud Architect or Professional Cloud Security Engineer certification
• OSCP or comparable hands-on offensive-security certifications (e.g., OSEP, GXPN, PNPT) demonstrating strong adversarial reasoning and exploit-focused problem-solving capability.
• Experience with offensive-security methodologies (e.g., understanding attack chains, exploitation fundamentals, or red-team tooling) applied to defensive engineering contexts
• Interest in applied security researchsuch as vulnerability discovery, protocol analysis, or emerging-threat investigation

#LI-JS1