Product Security Engineer

Responsibilities

You will lead threat modeling and security design reviews while architecting security gates within CI/CD pipelines. Additionally, you will manage product vulnerabilities, define secure SDLC standards, and coordinate penetration testing to ensure platform integrity.

Requirements

The role requires a strong software engineering background with hands-on experience in application security tooling and threat modeling for distributed systems. Candidates must be capable of leading cross-team initiatives and making risk-based decisions in an ambiguous environment.

Skills

• Product security
• Threat modeling
• Security design reviews
• SAST
• SCA
• Secrets scanning
• DAST
• CI/CD pipelines
• Vulnerability management
• CVE remediation
• Secure SDLC
• Penetration testing
• Distributed systems
• Cloud security
• Risk-based decision making

Benefits

• Health insurance
• Dental insurance
• Vision insurance
• Unlimited paid vacation
• Parental leave
• Fertility and family planning
• Daily lunch
• Wellness stipend
• Hardware sensor stipend
• Learning and development stipend
• 401(k)
• Equity

About this role

ABOUT NOMINAL

Engineers today are building some of the most ambitious machines humanity has
ever seen. They should have AI that’s purpose-built for them.

Nominal is building the Hardware Intelligence Platform that gives engineers
increased visibility into complex physical systems, helps them make better
decisions, and ultimately gets their products into the real world faster. It
brings together the systems, data, intelligence, and applications hardware
engineering requires to meet the AI moment. Hardware engineering teams use
Nominal to simulate, test, manufacture, and operate the physical systems that
keep the world moving, from spacecraft and autonomous vehicles to
next-generation energy systems and robotics.

Our customers span aerospace, defense, manufacturing, transportation, energy,
and robotics. They include Anduril, Shield AI, Wisk Aero, Pratt Miller
Motorsports, Antares, and Shinkei Systems, amongst others, alongside programs
within the U.S. Air Force and Navy. Our team draws from SpaceX, Palantir,
Anduril, Applied Intuition, Tesla, and other leading companies, united by a
common mission: giving hardware engineers the tools to build the future with
speed, safety, and confidence. We're a fast-moving team that owns problems
end-to-end, works across disciplines, and thrives at the intersection of
hardware and software.

Some of the world’s leading technology investors, including Sequoia, Lightspeed,
Founders Fund, General Catalyst, Lux Capital, and Insight Partners, are backing
Nominal’s ambition to change how machines are built and operated. We’re looking
for engineers who want to take on hard problems and help make a new generation
of world-changing hardware possible.

🧭 ABOUT THE ROLE

Our customers trust us with the data and controls behind their hardware
programs, so the security of our platform is part of the product itself. It has
to be designed in from the first architecture review and held up through every
release, not checked at the end. Product Security is the function that makes
that the default for how we build.

We’re looking for a Product Security Engineer to do that work. You’ll review
designs for new services and features, build the SAST, SCA, secrets-scanning,
and DAST gates that run in our pipelines, and own fixing what they find, from
CVE remediation to penetration test follow-up. Your influence will come from
being useful to the engineers shipping code. Because this is a standalone
function, it’s up to you to set the standard for what good looks like.

This is a high-ownership role for a software engineer who has moved into
security and knows that secure products are designed in, not bolted on at the
end.

🚀 WHAT YOU’LL DO

* Lead threat modeling and security design reviews for new services and
features, so design flaws are found and fixed before code ships.
* Architect and own SAST, SCA, and secrets-scanning gates in our CI/CD
pipelines, tuned so engineers trust the results and act on them.
* Own our DAST program, from tool selection and coverage through triage of
findings with the teams that own the affected services.
* Run product vulnerability management, including the CVE remediation workflow
and SLAs, and drive fixes across multiple engineering teams.
* Define secure SDLC standards and enable developers with guidance, tooling,
and examples they can apply without security in the loop.
* Scope and coordinate penetration tests, then drive remediation of findings to
closure with the responsible teams.
* Define security requirements for customer-facing features and integrations,
and mentor engineers on applying them.

🔍 WE’RE LOOKING FOR SOMEONE WITH

* Strong software engineering background, including experience building and
reviewing production services in at least one modern language.
* Hands-on experience performing threat modeling and security design reviews
for distributed systems or cloud-hosted services.
* Experience operating application security tooling in CI/CD pipelines, such as
SAST, SCA, secrets scanning, and DAST.
* Experience running a vulnerability management process, including triage,
prioritization by real exploitability, and remediation tracking against SLAs.
* Experience scoping penetration tests and working with testers and engineering
teams to close findings.
* A record of writing security standards or requirements that engineering teams
adopt in practice.
* Ability to lead cross-team work and make risk-based decisions amid ambiguity,
influencing engineers without direct authority.

⚡ SKILLS THAT SUPERCHARGE US

* Experience securing software deployed on-prem or in air-gapped environments.
* Familiarity with defense or aerospace compliance frameworks, such as NIST
800-53 or 800-171, or experience shipping software under ITAR or CUI
constraints.
* Hands-on use of software supply chain security practices, such as SBOM
generation and artifact signing.
* Certified Kubernetes Security Specialist (CKS) certification, or equivalent
hands-on experience securing Kubernetes workloads.
* Experience building a product security program from an early stage.

✨ BENEFITS/PERKS

* 🏥 100% covered health, dental, and vision insurance (for you and your
family)
* 🏖️ Unlimited paid vacation
* 👶 12 weeks parental leave
* 🌱 Fertility and family planning ($15,000 lifetime)
* 🍽️ Lunch provided daily
* 💪 Wellness stipend ($100/month)
* 🛠️ $500/year hardware sensor stipend
* 🚀 Learning and development stipend
* 💼 401(k)
* 📈 Employee-friendly equity terms
* 🏢 In-office 5 days per week

All qualified applicants will receive consideration for employment without
regard to race, color, religion, sex, sexual orientation, gender identity, or
national origin.

ITAR Requirements
To conform to U.S. Government export regulations, applicant must be a (i) U.S.
citizen or national, (ii) U.S. lawful, permanent resident (aka green card
ho...

About Nominal

Software Development · 201-500 employees · headquartered in Austin, TX · founded 2022