Staff Product Security Engineer, AI Security & Security Assurance

Medallia is the pioneer and market leader in Experience Management. Our award-winning SaaS platform, Medallia Experience Cloud, leads the market in the management of experiences, insights, and actions for candidates, customers, employees, patients, and residents alike.   We believe that every experience is a memory that can last a lifetime. Experiences shape the way people feel about a company. And they greatly influence how likely people are to advocate, contribute, and stay. At Medallia, we are committed to creating a world where organizations are loved by their customers and their employees. We empower exceptional people to create extraordinary experiences together.  Bring your whole self. The Role and Team We are seeking an experienced Staff Product Security Engineer to help drive security across our products and platforms. This individual will serve as a senior technical contributor within Product Security, partnering closely with Engineering, Product, Architecture, and other Security teams to identify risks, design practical security solutions, and embed security throughout the software development lifecycle. The ideal candidate combines strong hands-on application and product security expertise with the ability to independently lead complex security initiatives. They will help establish scalable security patterns, improve security automation, guide engineering teams through complex security decisions, and mentor other security engineers. This is a highly technical individual contributor role with significant cross-functional influence.

Product Security Engineering Lead security reviews for complex products, features, services, and architectures. Perform threat modeling and identify security risks early in the product development lifecycle. Partner with engineering teams to design practical mitigations and secure architecture patterns. Provide technical guidance on application, API, cloud, platform, and AI security. Serve as a security partner for major engineering initiatives from design through production. Secure Development Lifecycle Help evolve and scale Product Security controls throughout the SDLC. Embed security into developer workflows through automated and developer-friendly security controls. Develop reusable security standards, patterns, guidelines, and reference architectures. Identify opportunities to shift security reviews earlier into requirements, design, and development. Drive adoption of secure-by-default engineering practices. Vulnerability & Risk Management Analyze and prioritize vulnerabilities based on exploitability, reachability, business impact, and customer risk. Partner with engineering teams to develop effective remediation strategies. Lead investigation of complex or high-impact product security vulnerabilities. Identify systemic vulnerability patterns and drive broader remediation rather than addressing findings individually. Provide technical input for risk acceptance and security exception decisions. Security Automation & Tooling Help design, implement, and optimize security capabilities including: SAST SCA Secrets Detection DAST Container and Cloud Security ASPM platforms AI-assisted security reviews Automate repetitive security activities and reduce reliance on manual reviews. Improve developer experience by integrating security controls directly into engineering workflows. Develop meaningful metrics for security coverage, adoption, prevention, and remediation. AI & Emerging Technology Security Perform security reviews of GenAI and AI-enabled products. Assess risks associated with LLMs, AI agents, MCP integrations, tool invocation, and emerging AI architectures. Help develop security standards and reusable patterns for AI-enabled applications. Partner with engineering teams to integrate security controls into AI development workflows. Cross-Functional Leadership Independently lead Product Security initiatives involving multiple engineering teams. Build