Staff Product Security Engineer, AI Security & Security Assurance

Medallia is the pioneer and market leader in Experience Management. Our award-winning SaaS platform, Medallia Experience Cloud, leads the market in the management of experiences, insights, and actions for candidates, customers, employees, patients, and residents alike.

We believe that every experience is a memory that can last a lifetime. Experiences shape the way people feel about a company. And they greatly influence how likely people are to advocate, contribute, and stay. At Medallia, we are committed to creating a world where organizations are loved by their customers and their employees.

We empower exceptional people to create extraordinary experiences together.

Bring your whole self.

The Role and Team

We are seeking an experienced Staff Product Security Engineer to help drive security across our products and platforms. This individual will serve as a senior technical contributor within Product Security, partnering closely with Engineering, Product, Architecture, and other Security teams to identify risks, design practical security solutions, and embed security throughout the software development lifecycle.

The ideal candidate combines strong hands-on application and product security expertise with the ability to independently lead complex security initiatives. They will help establish scalable security patterns, improve security automation, guide engineering teams through complex security decisions, and mentor other security engineers.

This is a highly technical individual contributor role with significant cross-functional influence.

Product Security Engineering

• Lead security reviews for complex products, features, services, and architectures.
• Perform threat modeling and identify security risks early in the product development lifecycle.
• Partner with engineering teams to design practical mitigations and secure architecture patterns.
• Provide technical guidance on application, API, cloud, platform, and AI security.
• Serve as a security partner for major engineering initiatives from design through production.

Secure Development Lifecycle

• Help evolve and scale Product Security controls throughout the SDLC.
• Embed security into developer workflows through automated and developer-friendly security controls.
• Develop reusable security standards, patterns, guidelines, and reference architectures.
• Identify opportunities to shift security reviews earlier into requirements, design, and development.
• Drive adoption of secure-by-default engineering practices.

Vulnerability & Risk Management

• Analyze and prioritize vulnerabilities based on exploitability, reachability, business impact, and customer risk.
• Partner with engineering teams to develop effective remediation strategies.
• Lead investigation of complex or high-impact product security vulnerabilities.
• Identify systemic vulnerability patterns and drive broader remediation rather than addressing findings individually.
• Provide technical input for risk acceptance and security exception decisions.

Security Automation & Tooling

• Help design, implement, and optimize security capabilities including:
  • SAST
  • SCA
  • Secrets Detection
  • DAST
  • Container and Cloud Security
  • ASPM platforms
  • AI-assisted security reviews
• Automate repetitive security activities and reduce reliance on manual reviews.
• Improve developer experience by integrating security controls directly into engineering workflows.
• Develop meaningful metrics for security coverage, adoption, prevention, and remediation.

AI & Emerging Technology Security

• Perform security reviews of GenAI and AI-enabled products.
• Assess risks associated with LLMs, AI agents, MCP integrations, tool invocation, and emerging AI architectures.
• Help develop security standards and reusable patterns for AI-enabled applications.
• Partner with engineering teams to integrate security controls into AI development workflows.

Cross-Functional Leadership

• Independently lead Product Security initiatives involving multiple engineering teams.
• Build strong partnerships with Engineering, Product, Architecture, Privacy, Compliance, and Security teams.
• Influence technical decisions through security expertise and practical recommendations.
• Mentor Product Security Engineers and help strengthen technical capabilities across the team.
• Represent Product Security in architecture reviews, technical discussions, and customer security engagements.

Candidates based in the Tysons Corner vicinity will be prioritized as this role is Hybrid, 3 days per week onsite.

Minimum Qualifications

• 8+ years of experience in application security, product security, security engineering, or related fields.
• Strong hands-on experience with:
  • Application Security
  • Secure Software Development Lifecycle (SSDLC)
  • Threat Modeling
  • Security Architecture Reviews
  • Vulnerability Management
  • Secure Coding Practices
• Experience securing modern application architectures including APIs, microservices, Kubernetes, containers, and cloud-native services.
• Experience with public cloud environments, preferably AWS.
• Experience with application security tooling such as SAST, SCA, secrets detection, DAST, and ASPM platforms.
• Strong understanding of common application security risks and frameworks, including OWASP.
• Ability to independently investigate complex security issues and develop practical remediation strategies.
• Demonstrated ability to influence engineering teams without direct authority.
• Strong written and verbal communication skills.
• Professional working proficiency in written and spoken English.

Preferred

• Experience securing AI/ML systems, GenAI applications, LLMs, AI agents, or MCP-based architectures.
• Experience developing security automation or integrating security controls into CI/CD and developer workflows.
• Experience with cloud and container security technologies.
• Familiarity with NIST, SOC 2, ISO 27001, PCI DSS, or similar frameworks.
• Experience supporting customer security reviews or security escalations.
• Security certifications such as CISSP, CSSLP, GIAC, AWS Security Specialty, or equivalent.

Success Measures

Within the first year, this individual will:

• Independently lead complex Product Security initiatives.
• Improve security coverage and automation across engineering workflows.
• Establish reusable security patterns adopted by multiple engineering teams.
• Identify and address systemic security risks rather than individual vulnerabilities alone.
• Improve developer adoption of Product Security controls.
• Provide effective technical mentorship to other security engineers.
• Become a trusted security partner to Engineering and Product teams.

Leadership Expectations

• A Staff Product Security Engineer is expected to:
• Own complex security problems from identification through resolution.
• Think beyond individual findings and identify systemic solutions.
• Influence technical decisions across multiple teams.
• Balance security risk, engineering complexity, and business needs.
• Provide strong technical mentorship to other engineers.
• Operate independently while knowing when broader leadership alignment is required.
• Create scalable solutions that reduce security friction for engineering teams.

Medallia is committed to equal pay and transparency. The annual base salary range for this position is $154,000 - $205,000. Please note that the salary range information provided is a general guideline and combines all of the distinct labor markets within the US. It is uncommon for an individual to be hired at or near the top of the range for their role and compensation decisions are dependent on a variety of factors. Medallia considers factors such as (but not limited to) scope and responsibilities of the position, candidate's work experience, candidate's work location, education/training, key skills, internal peer equity, external market data, as well as, market and business considerations when making compensation decisions.

Medallia also offers competitive health and wellness benefits, including but not limited to medical, dental, vision, 401(k), short-term and long-term disability, life and AD&D insurance, statutory leaves, paid parental leave, and paid holidays. Benefits and eligibility may vary by location and role.

At Medallia, we celebrate diversity and recognize the value it brings to our customers and employees. Medallia is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age (40 and over), disability, genetic information, veteran status or military service, or any other status protected by state or local law. Individuals with a disability who need an accommodation to apply please contact us at ApplicantAccessibility@medallia.com. For information regarding how Medallia collects and uses personal information, please review our Privacy Policies. Applications will be accepted for 30 days from the date this role was posted or until the role has been filled.