Senior Product Security Engineer

New York, Atlanta, Remote East Coast (US)
SoundCloud empowers artists and fans to connect and share through music. Founded in 2007, SoundCloud is an artist-first platform empowering artists to build and grow their careers by providing them with the most progressive tools, services, and resources. With over 400+ million tracks from 40 million artists, the future of music is SoundCloud.
 
We are looking for a ProdSec engineer to join our Security team!

As a Product Security Engineer, you will collaborate cross-functionally with engineering teams to identify and address potential vulnerabilities and implement robust security measures in our products and services. You will advocate and shape security best practices across SoundCloud’s Engineering, Product, and Design (“EPD”) organization. This position has a unique opportunity to play a direct and pivotal role in safeguarding our products against emerging cyber threats to our platform, artists and creators, and listeners and fans.

Key Responsibilities:

  • Conduct code reviews and threat modeling exercises to identify and remediate potential security vulnerabilities
  • Drive efforts to automate the security of our Software Development Lifecycle
  • Define, implement, and oversee processes and policies in our Vulnerability Management Program
  • Triage and drive to remediation submissions from our external bug bounty program
  • Participate in our security incident response process
  • Make recommendations to product and teams about how to improve the consumer security of our platform
  • Identify security anti-patterns in our codebases and architecture, and make recommendations to engineering on how to improve them
  • Help guide our Engineering and Product teams around the safe and responsible use of Generative AI in our products and SDLCs.
  • Promote and implement security best practices through educational initiatives, such as CTFs and technical talks
  • Improve internal tooling, processes, and documentation
  • Mentor and onboard new team members

Experience and Background:

  • 5+ years of product or application security experience, or other relevant software engineering experience
  • Enthusiasm about collaborating with engineering and product teams to proactively address security issues in products
  • Experience conducting threat modeling exercises and secure code reviews
  • Experience configuring DevSecOps tools (e.g. SAST, SCA, Secret Scanning)
  • Experience managing bug bounty programs
  • Familiarity with languages such as Javascript, Go, Ruby, Python, or Scala
  • Experience working with cloud providers (AWS, GCP) and Developer SaaS solutions (GitHub, Jira)
  • Familiarity with IaC tools such as Terraform
  • Ability to effectively communicate risk to technical and non-technical audiences
  • Experience with data analysis (SQL) in order to determine scope and impact of vulnerabilities
  • Knowledge of industry-standard security frameworks and regulations, such as GDPR, CCPA, SOC2, NIS2, and OWASP is a plus
  • Experience with vulnerability management is a plus
  • Experience threat modelling Generative AI applications & use-cases in the context of the EU AI Act is a plus 

The salary range for this role is $140,000 - $180,000 annually. The final salary offered will be determined based on relative experience, skills, internal equity, and location. We also offer a generous total rewards program - read more about additional benefits and perks below!

About us:

  • We are a multinational company with offices in the US (New York and Los Angeles), Germany (Berlin), and the UK (London)
  • We provide a flexible work culture that offers the opportunity to collaborate and connect in person at our offices as well as accommodating work from home
  • We are deeply committed to ensuring diversity, equity and inclusion at all levels of our organization and fostering a community where everyone’s voice, perspective and experience is respected and heard
  • We believe a strong team is made by investing in employees through mentorship, workshops and enrichment opportunities

Benefits:

  • Comprehensive health benefits including medical, dental, and vision plans, as well as mental health resources
  • Robust 401k program
  • Employee Equity Plan
  • Generous professional development allowance
  • Interested in a gym membership, photography course or book? We have a Creativity and Wellness benefit!
  • Flexible vacation and public holiday policy where you can take up to 35 days of PTO annually
  • 16 paid weeks for all parents (birthing and non-birthing), regardless of gender, to welcome newborns, adopted and foster children
  • Various snacks, goodies, and 2 free lunches weekly when at the office

Diversity, Equity and Inclusion at SoundCloud

SoundCloud is for everyone. Diversity and open expression are fundamental to our organization; they help us lead what’s next in music by understanding and empowering our creators and fans, no matter their identity. We acknowledge the challenges in the music industry, and strive to influence an inclusive culture where everyone can contribute respectfully and thrive, especially the historically marginalized communities that many of our creators, fans and SoundClouders identify with. We are dedicated to creating an inclusive environment at SoundCloud for everyone, regardless of gender identity, sexual orientation, race, ethnicity, migration background, national origin, age, disability status, or care-giver status.

At SoundCloud you can find your community or elevate your allyship by joining a Diversity Resource Group. Diversity Resource Groups are employee-organized groups focused on supporting and promoting the interests of a particular underrepresented community in order to build a more inclusive culture at SoundCloud. Anyone can join, whether you share the identity or strive to be an ally.

Create a Job Alert

Interested in building your career at SoundCloud? Get future opportunities sent straight to your email.

Apply for this job

*

indicates a required field

Resume/CV*

Accepted file types: pdf, doc, docx, txt, rtf

Cover Letter

Accepted file types: pdf, doc, docx, txt, rtf

Select...

Will you now, or in the future, require sponsorship for employment visa status (e.g. H-1B visa status)? Applicants must be currently authorized to work for any employer in the United States. SoundCloud does not sponsor applicants for employment visas including for those losing OPT status and needing sponsorship. 

Please select YES if you now, or in the future, require sponsorship for employment visa status. 

Select...

When you apply to a job on this site, the personal data contained in your application will be collected by SoundCloud Inc. (located at 2 Gansevoort St., 6th Floor, New York, NY 10014, USA) if you are applying from the US and SoundCloud Global Limited & Co. KG (located at Rheinsberger Str. 76/77, 10115 Berlin, Germany) if you are applying from outside the US (“SoundCloud”). SoundCloud's data protection officer can be contacted by emailing dataprotection@soundcloud.com. Your personal data will be processed for the purposes of managing SoundCloud’s recruitment related activities, which include setting up and conducting interviews and tests for applicants, evaluating and assessing the results thereto, and as is otherwise needed in the recruitment and hiring processes. Such processing is legally permissible under the regulation of the GDPR and BDSG, as necessary for the establishment of an employment relationship.

Your personal data will be shared with Greenhouse Software, Inc., a cloud services provider located in the United States of America and engaged by SoundCloud to help manage its recruitment and hiring process on SoundCloud’s behalf. Accordingly, if you are located outside of the United States, your personal data will be transferred to the United States once you submit it through this site. The organization provides an adequate and sufficient level of protection in accordance with the Data Privacy Framework in conjunction with the EU adequacy decision.

Your personal data will be retained by SoundCloud as long as SoundCloud determines it is necessary to evaluate your application for employment, which typically does not exceed a period of six months from hiring an applicant for the advertised vacancy. If you would like us to take your data into account for future job advertisements, please let us know separately. With your explicit consent, we will retain your data for a maximum period of twenty-four months.  Under the GDPR, you have the right to request access to your personal data, to request that your personal data be rectified or erased, and to request that processing of your personal data be restricted. You also have the right to data portability and the right to object. You also have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. In addition, you may lodge a complaint with an EU supervisory authority.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in SoundCloud’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

Select...
Select...
Race & Ethnicity Definitions

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Select...

Voluntary Self-Identification of Disability

Form CC-305
Page 1 of 1
OMB Control Number 1250-0005
Expires 04/30/2026

Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at www.dol.gov/ofccp.

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

  • Alcohol or other substance use disorder (not currently using drugs illegally)
  • Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
  • Blind or low vision
  • Cancer (past or present)
  • Cardiovascular or heart disease
  • Celiac disease
  • Cerebral palsy
  • Deaf or serious difficulty hearing
  • Diabetes
  • Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
  • Epilepsy or other seizure disorder
  • Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
  • Intellectual or developmental disability
  • Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
  • Missing limbs or partially missing limbs
  • Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
  • Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
  • Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
  • Partial or complete paralysis (any cause)
  • Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
  • Short stature (dwarfism)
  • Traumatic brain injury
Select...

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.