Security Engineer in Product Security

Role Overview

Join JetBrains' Product Security team to safeguard our products and services used by millions of developers worldwide. You will establish and maintain security processes, conduct in-depth security reviews, and help build a developer-friendly security culture.

Key Responsibilities

• Conduct security tests and reviews of JetBrains web and desktop products, including features, designs, architecture, and code
• Perform threat modeling and risk assessments for new features, components, and integrations
• Establish and improve Secure Software Development Lifecycle (SSDLC) and Application Security processes across product teams
• Research and address new attack vectors and threats, designing effective defenses
• Develop, integrate, and maintain security pipelines and tools that automate security controls into the development workflow
• Research and implement AI/LLM-based approaches for security automation
• Investigate and triage vulnerability reports from external researchers
• Provide security guidance and practical solutions to product teams
• Create security guidelines, deliver talks, and design CTF challenges

Required Skills & Experience

• Proven experience in Application Security and/or Penetration Testing
• Solid knowledge of Web Application Security principles, common attacks, and OWASP TOP 10
• Degree in Computer Science, Information Technology, or equivalent experience
• Strong English communication skills, both written and verbal
• Strong experience in vulnerability analysis and proof-of-concept development
• Understanding of cloud security fundamentals (AWS, GCP, Azure)
• Knowledge of modern software development lifecycle (code reviews, CI/CD, packaging)
• Experience in secure coding and security-focused code reviews
• Analytical and problem-solving mindset; ability to work independently and in teams

Nice-to-Have

• Experience building security pipelines and integrating them into CI/CD workflows
• Security design review, architecture, system hardening, and risk assessment expertise
• Development of internal security tools or plugins for developer teams
• AI/LLM applications in security tooling
• Programming skills in Kotlin, Java, Python, or Go
• Desktop application security knowledge (Windows, macOS, Unix)
• Hands-on experience with SAST, DAST, SCA, or fuzzing tools
• Bug bounty program experience (as researcher or triager)
• CTF or security competition participation
• Relevant certifications (OSCP, OSWE, GXPN, CISSP)
• Knowledge of GDPR, SOC 2, ISO 27001, and AI regulations