Senior Product Security Engineer

About this role

Are you ready for what’s next?  

Come explore opportunities within Brunswick, a global marine leader committed to challenging conventions and innovating next-generation technologies that transform experiences on the water and beyond.  Brunswick believes “Next Never Rests™,” and we offer a variety of exciting careers and growth opportunities within united teams defining the future of marine recreation. 

Location:  Mettawa, IL Workplace Category: Hybrid Travel Required:  Ability to travel domestically and internationally, up to 15% as business needs require. Direct Reports:  None Pay Range:   $118,400 - $174,000 Visa Sponsorship:  Applicants must be currently authorized to work in the United States.  This position is not eligible for employment visa sponsorship now or in the future.     Relocation: Relocation assistance is not routinely provided and may be considered for exceptional candidates. 

Innovation is the heart of Brunswick.  See how your contributions will help transform vision into reality:  

Position Overview :    The Product Security team is responsible for protecting our customers and Brunswick Corporation from evolving security threats in our products. Product security encompasses secure systems, hardware and software design of both devices and the systems to which they connect (cloud, infrastructure, server, etc.).  The Product Security team partners with application development, product engineering, cloud, infrastructure, and DevSecOps teams to integrate security throughout the product lifecycle, instituting a Secure Systems/Software Development Life Cycle (SDLC) and application of applicable standards and best practices. 

As a Senior Product Security Engineer, you will serve as a technical leader and trusted advisor responsible for maturing product security capabilities, improving secure development practices, and reducing product security risk across Brunswick's product portfolio. The role requires close collaboration with development teams, architects, DevSecOps engineers, cloud engineers, and business stakeholders to ensure security is embedded throughout the product lifecycle with a secure by design and default approach.

This position is responsible for advancing Brunswick's product security program through the implementation and oversight of product security governance, threat modeling, providing architectural/design guidance, developer enablement, vulnerability management, security testing, security tooling, and DevSecOps practices. The role provides technical leadership for product security initiatives, develops and maintains security policies, standards, guidelines, and best practices, and partners with engineering teams to embed security throughout the product lifecycle.  Additionally, this position plays a key role in maturing and scaling Brunswick's Security by Design program to support secure, resilient, and high-quality product development across all business units. Success in this role requires a strong understanding of potential security threats, secure system architecture, hardware security, secure software development, application security, cloud-native technologies, software supply chain security, security automation, and modern development methodologies. The ideal candidate possesses strong technical, analytical, and communication skills and can effectively collaborate with stakeholders across engineering teams to drive secure development practices and advance Brunswick's product security objectives.

Key Responsibilities • Help build maturity of product development teams in product security through training and mentoring. • Conduct threat modeling, attack surface analysis, and product security risk assessments for new and existing products and applications and recommend mitigating controls. • Lead product security design reviews and participate in architecture review processes, identifying potential weaknesses or vulnerabilities and recommend appropriate changes. • Partner with development teams to integrate security requirements into product architecture, design, development, testing, deployment, and maintenance activities. • Define, maintain, and promote product security policies, standards, procedures, best practices, and technical guidance. • Review false-positive requests, mitigation plans, and risk exception submissions in accordance with established security governance processes. • Establish security testing requirements and assist teams in implementing security verification and validation throughout the development lifecycle. • Provide security consultation for web applications, mobile applications, cloud-native applications, microservices, embedded software, and Application Programming Interfaces (APIs). • Serve as a senior subject matter expert for product security, secure software development, and DevSecOps practices. • Support the implementation of secure coding practices aligned with OWASP, CWE, Security by Design requirements, and Brunswick secure development standards. • Review and analyze application security findings and provide remediation guidance to development teams. • Support developers in resolving vulnerabilities related to applicable product security coding standards such as the Open Worldwide Application Security Project (OWASP) Top 10 risks, Common Weakness Enumeration (CWE) Top 25 weaknesses, authentication, authorization, session management, cryptography, injection attacks, and software supply chain risks. • Monitor vulnerability remediation activities and validate remediation effectiveness through rescanning and testing. • Provide guidance on software supply chain security, Software Bill of Materials (SBOM) and Hardware Bill of Materials (HBOM) creation, dependency management, and open-source software risk reduction. • Collaborate with Security Architecture, Cloud Security, Infrastructure Security, and Engineering teams to improve organizational security maturity. • Support vulnerability management processes, includin

Similar jobs

• Senior Product Security Engineer — Clear · New York, New York, United States
• Senior Product Security Engineer — Clickhouse · Remote
• Senior Product Security Engineer — Persona · San Francisco
• Senior Product Security Engineer — Chainguard · Remote
• Senior Product Security Engineer — Harvey · San Francisco
• Senior Product Security Engineer — Mach · Huntington Beach, CA
• Senior Product Security Engineer — Harnessinc · Remote
• Senior Product Security Engineer — Allegion · Golden, CO | Indianapolis, IN - Hague Rd