At Workiva, the Senior Product &amp; Application Security Engineer partners closely with product and engineering teams to ensure the security of our applications, code, and cloud-based infrastructure. This role does not focus on direct feature development, but instead works alongside engineers to review code, assess application and infrastructure security, and provide guidance on secure design and implementation across the Workiva platform.This position requires broad security expertise and extensive hands-on software development experience, enabling the engineer to approach security challenges with a developer’s mindset. The role supports a wide range of product and environment security needs and serves as a key technical backup to senior security leadership. We are especially interested in candidates from engineering backgrounds who are interested in moving into security, bringing deep product knowledge and practical development experience to strengthen Workiva’s security posture. What You’ll Do<ul><li>Serves as a senior product and application security partner to engineering and product teams across the organization</li><li>Leads the application of security techniques threat modeling and secure design practices to protect applications cloud infrastructure and product environments</li><li>Contributes at a senior level within a team or matrixed environment influencing security strategy and execution</li></ul><h2>Problem Solving</h2><ul><li>Tackles complex and ambiguous security problems requiring deep technical analysis and evaluation of multiple risk factors</li><li>Proactively identifies systemic security risks across products services and infrastructure</li><li>Designs and drives effective long term security solutions and remediation strategies across diverse product areas</li></ul><h2>Discretion and Impact</h2><ul><li>Has significant impact on product security customer trust compliance and operational risk across multiple teams and initiatives</li><li>Exercises strong judgment in defining security priorities selecting scalable controls and balancing risk with business needs</li></ul><h2>Collaboration and Interaction</h2><ul><li>Acts as a trusted security advisor to senior engineers technical leads and engineering managers</li><li>Regularly collaborates across product engineering platform and infrastructure teams to influence secure architecture and design decisions</li><li>Engages with senior internal stakeholders and may support discussions with directors and senior directors on security topics</li></ul><h2>Autonomy</h2><ul><li>Operates with a high degree of independence setting direction and priorities aligned with organizational security objectives</li><li>Owns security assessments risk evaluations and remediation efforts from discovery through resolution</li><li>Mentors and provides technical leadership to peers and partner teams</li></ul><h2>What You’ll Need</h2>Minimum Qualifications<ul><li>3+ years of related experience with a Bachelor’s degree or equivalent experience</li><li>3+ years of software development experience in at least one of the following languages: Java, Javascript/Typescript, Python, Go</li><li>Knowledge of security vulnerabilities, secure code review, and OWASP Top 10</li></ul>Preferred Qualifications<ul><li>Deep knowledge of application security secure coding practices threat modeling and vulnerability classes including OWASP Top 10</li><li>Proven experience leading secure code reviews architecture reviews and security design discussions Ability to communicate complex security concepts risks and recommendations to both technical and executive stakeholders</li><li>Experience using web application security testing tools such as Burp Suite</li><li>Strong understanding of cloud security concepts particularly in AWS based environments</li></ul><ul><li>Advanced web application penetration testing certifications such as OSWA OSWE OSCP BSCP eWTP GWAPT</li><li>Secure code review or application security certifications such as CASE Java or OSWE</li><li>Web Application Firewall WAF tuning and optimization experience</li><li>Hands on penetration testing experience across modern web applications</li><li>Familiarity with DevSecOps tooling such as Semgrep GitHub Advanced Security Trivy Grype or similar</li><li>Experience securing or evaluating AI driven systems and workflows</li></ul>Travel Requirements &amp; Working Conditions<ul><li>For remote working opportunities, a stable internet connection is required</li><li>Occasional travel may be needed for team meetings, conferences, or company events</li></ul>How You’ll Be Rewarded✅ Salary range in the US: $111,000.00 - $178,000.00✅ A discretionary bonus typically paid annually✅ Restricted Stock Units granted at time of hire✅ 401(k) match and comprehensive employee benefits packageThe salary range represents the low and high end of the salary range for this job in the US. Minimums and maximums may vary based on location. The actual salary offer will carefully consider a wide range of factors, including your skills, qualifications, experience and other relevant factors.Employment decisions are made without regard to age, race, creed, color, religion, sex, national origin, ancestry, disability status, veteran status, sexual orientation, gender identity or expression, genetic information, marital status, citizenship status or any other protected characteristic.Workiva is committed to working with and providing reasonable accommodations to applicants with disabilities. To request assistance with the application process, please email <a href="mailto:talentacquisition@workiva.com">talentacquisition@workiva.com</a>.  Workiva employees are required to undergo comprehensive security and privacy training tailored to their roles, ensuring adherence to company policies and regulatory standards.Workiva supports employees in working where they work best - either from an office or remotely from any location within their country of employment.#LI-MJ2

Workiva is on a mission to power transparent reporting for a better world. We build and deliver the world&rsquo;s leading cloud platform for assured integrated reporting to meet stakeholder demands for action, transparency, and disclosure of financial and non-financial data. Workiva offers the only unified SaaS platform that brings customers&rsquo; financial reporting, Environmental, Social, and Governance (ESG), and Governance, Risk, and Compliance (GRC) together in a controlled, secure, audit-ready platform. Our platform simplifies the most complex reporting and disclosure challenges by streamlining processes, connecting data and teams, and ensuring consistency. Learn more at workiva.com.

Senior Product & Application Security Engineer

At Workiva, the Senior Product &amp; Application Security Engineer partners closely with product and engineering teams to ensure the security of our applications, code, and cloud-based infrastructure. This role does not focus on direct feature development, but instead works alongside engineers to review code, assess application and infrastructure security, and provide guidance on secure design and implementation across the Workiva platform.This position requires broad security expertise and extensive hands-on software development experience, enabling the engineer to approach security challenges with a developer’s mindset. The role supports a wide range of product and environment security needs and serves as a key technical backup to senior security leadership. We are especially interested in candidates from engineering backgrounds who are interested in moving into security, bringing deep product knowledge and practical development experience to strengthen Workiva’s security posture. What You’ll Do<ul><li>Serves as a senior product and application security partner to engineering and product teams across the organization</li><li>Leads the application of security techniques threat modeling and secure design practices to protect applications cloud infrastructure and product environments</li><li>Contributes at a senior level within a team or matrixed environment influencing security strategy and execution</li></ul><h2>Problem Solving</h2><ul><li>Tackles complex and ambiguous security problems requiring deep technical analysis and evaluation of multiple risk factors</li><li>Proactively identifies systemic security risks across products services and infrastructure</li><li>Designs and drives effective long term security solutions and remediation strategies across diverse product areas</li></ul><h2>Discretion and Impact</h2><ul><li>Has significant impact on product security customer trust compliance and operational risk across multiple teams and initiatives</li><li>Exercises strong judgment in defining security priorities selecting scalable controls and balancing risk with business needs</li></ul><h2>Collaboration and Interaction</h2><ul><li>Acts as a trusted security advisor to senior engineers technical leads and engineering managers</li><li>Regularly collaborates across product engineering platform and infrastructure teams to influence secure architecture and design decisions</li><li>Engages with senior internal stakeholders and may support discussions with directors and senior directors on security topics</li></ul><h2>Autonomy</h2><ul><li>Operates with a high degree of independence setting direction and priorities aligned with organizational security objectives</li><li>Owns security assessments risk evaluations and remediation efforts from discovery through resolution</li><li>Mentors and provides technical leadership to peers and partner teams</li></ul><h2>What You’ll Need</h2>Minimum Qualifications<ul><li>3+ years of related experience with a Bachelor’s degree or equivalent experience</li><li>3+ years of software development experience in at least one of the following languages: Java, Javascript/Typescript, Python, Go</li><li>Knowledge of security vulnerabilities, secure code review, and OWASP Top 10</li></ul>Preferred Qualifications<ul><li>Deep knowledge of application security secure coding practices threat modeling and vulnerability classes including OWASP Top 10</li><li>Proven experience leading secure code reviews architecture reviews and security design discussions Ability to communicate complex security concepts risks and recommendations to both technical and executive stakeholders</li><li>Experience using web application security testing tools such as Burp Suite</li><li>Strong understanding of cloud security concepts particularly in AWS based environments</li></ul><ul><li>Advanced web application penetration testing certifications such as OSWA OSWE OSCP BSCP eWTP GWAPT</li><li>Secure code review or application security certifications such as CASE Java or OSWE</li><li>Web Application Firewall WAF tuning and optimization experience</li><li>Hands on penetration testing experience across modern web applications</li><li>Familiarity with DevSecOps tooling such as Semgrep GitHub Advanced Security Trivy Grype or similar</li><li>Experience securing or evaluating AI driven systems and workflows</li></ul>Travel Requirements &amp; Working Conditions<ul><li>For remote working opportunities, a stable internet connection is required</li><li>Occasional travel may be needed for team meetings, conferences, or company events</li></ul>How You’ll Be Rewarded✅ Salary range in the US: $111,000.00 - $178,000.00✅ A discretionary bonus typically paid annually✅ Restricted Stock Units granted at time of hire✅ 401(k) match and comprehensive employee benefits packageThe salary range represents the low and high end of the salary range for this job in the US. Minimums and maximums may vary based on location. The actual salary offer will carefully consider a wide range of factors, including your skills, qualifications, experience and other relevant factors.Employment decisions are made without regard to age, race, creed, color, religion, sex, national origin, ancestry, disability status, veteran status, sexual orientation, gender identity or expression, genetic information, marital status, citizenship status or any other protected characteristic.Workiva is committed to working with and providing reasonable accommodations to applicants with disabilities. To request assistance with the application process, please email <a href="mailto:talentacquisition@workiva.com">talentacquisition@workiva.com</a>. &nbsp;Workiva employees are required to undergo comprehensive security and privacy training tailored to their roles, ensuring adherence to company policies and regulatory standards.Workiva supports employees in working where they work best - either from an office or remotely from any location within their country of employment.#LI-MJ2

Senior Product & Application Security Engineer

About the Job

About the Company

Workiva

Similar Jobs

Senior Director, Security Engineering

Senior Director, Security Engineering

Lead Application Security Engineer

Lead Application Security Engineer

Senior security engineer

Senior security engineer

Lead Security Engineer

Lead Security Engineer

Senior Security Engineer

Senior Security Engineer

Senior Security Engineer

Senior Security Engineer

Sr Information Security Analyst

Sr Information Security Analyst

Senior Security Analyst

Senior Security Analyst

Senior Security Engineer, Security Operations

Senior Security Engineer, Security Operations

Senior Enterprise Application Security Engineer (Hybrid - San Jose, CA)

Senior Enterprise Application Security Engineer (Hybrid - San Jose, CA)