Staff Product Security Engineer Overview SailPoint’s Cybersecurity organization is seeking a Staff Product Security Engineer with a passion for cybersecurity and protecting the organization. The ideal candidate combines strong application security expertise with practical software engineering experience and can effectively influence to build secure, resilient products at scale. This position reports to the Director of Cyber Product Security (CPS) and the successful candidate will join a team of security engineers who collaborate with stakeholders across the organization. This role will partner closely with Engineering and the other security teams within the Cyber organization to identify security risks, drive remediation efforts, and embed security throughout the product development process. Central to SailPoint’s product security program is the implementation of a shared security model that impacts all software developed by SailPoint. Under this model, CPS is responsible for multiple key areas affecting product security and collaborates with SailPoint's Engineering Product Security (EPS) team on areas of mutual responsibility. The shared responsibility model was developed to shift product security left, moving security checks to the earliest phases of our secure software development lifecycle. The staff product security engineer will have the opportunity to shape our future through process and technology optimization, capability acquisition and development, and maturation of our existing activities. They’ll already be comfortable with the 4 I’s at SailPoint (individual, Impact, Innovation, and Integrity) even if they’re new to the concept. They will embrace new challenges and will be a positive contributor to an already positive work culture and environment. Location is remote with the ability to work from anywhere within the continental United States. Key Responsibilities - Partner with Engineering teams throughout the software development lifecycle to identify and mitigate security risks, and implement secure deployment practices - Support threat modeling activities and help engineering teams implement appropriate security controls - Define and promote secure coding standards, security policies, best practices, and secure-by-design principles - Participate in the Cyber organization’s efforts to leverage AI across the team, as well as the use of AI in our SSDLC. - Partner with Engineering on improving security testing programs - Coordinate internal and external application and penetration testing initiatives - Validate vulnerability findings and prioritize remediation based on risk - Perform root cause analysis and recommend long-term security improvements - Collaborate with the Security Operations team on security monitoring and detection capabilities for applications and services - Triage, coordinate, and oversee remediation for security researcher disclosures via our bug bounty program - Develop security training, guidance, and technical documentation - Interact with other organizations at SailPoint as a consultant on security-related matters Required Qualifications Successful candidate will meet most, if not all of the following requirements: - 5-7 years of experience in product security, application security, software engineering, or a related field - Experience with security testing tools such as: SAST, SCA, DAST, Container security scanners - Experience with CI/CD security controls and DevSecOps practices - Familiarity with one or more programming languages such as Python, Go, Java, JavaScript/TypeScript, Ruby - Demonstrated ability to effectively use AI-powered tools and automation to enhance security engineering productivity, research, analysis, and remediation efforts - Knowledge of emerging AI security risks and best practices for securing AI-enabled applications, services, and development workflows - Deep expertise in threat modeling, secure architecture design, and vulnerability management - Experience influencing engineering organizations and driving security initiatives across multiple teams - Knowledge of artificial intelligence software security frameworks is strongly preferred, including OWASP AI Security and Privacy Guide, NIST AI Risk Management Framework, Cybersecurity AI (CAI), Open SSF AI/ML Security Framework. Core Competencies The successful candidate will: - Be a highly active observer of industry security trends and threats, remaining up to date on current cyber issues - Have a continuous learning mindset and passion for security - Have strong analytical and problem-solving skills - Be flexible, with the ability to balance security vs the needs of the business - Have excellent written and oral communications skills with demonstrated commitment to producing high quality documentation - Be able to translate technical risks into business impact - Be collaborative and able to foster relationships with teams we partner with First 90 Days: Discovery, Strategic Alignment, and Partnership - Strategic Alignment & Planning Integration: Deepen collaboration with key engineering and tooling leads by Day 90, reinforcing recurring touchpoints to integrate product security proactively into early planning cycles, roadmaps, and feature designs. - SDLC Optimization Assessment: Review the end-to-end Software Development Life Cycle (SDLC) by Day 60 to identify enhancement opportunities, accelerate "shift-left" practices, and further standardize secure-by-design deployment pipelines. - Asset & Dependency Inventory: Refine and centralize the inventory of supported products, underlying architecture, and third-party dependencies by Day 90 to deliver a highly visible, comprehensive single source of truth. First 6 Months: Advanced Tooling, Training, and Scalable Frameworks - Modernizing Tool Stack & AI Integration (Q3): Evaluate the current security tooling and implement state-of-the-art AI-assisted scanning across product code (utilizing tools like Cursor and Claude Enterprise) to further automate and scale security workflows. - Optimized Remediation & Board Metrics (Q4): Implement a highly scalable, risk-based vulnerability prioritization framework, optimizing Time to Remediate (TTR) metrics to provide clear, actionable risk visibility for executive leadership and the Board. - Security Champions & Developer Empowerment: Elevate developer security education and launch a formal "Security Champions" program by Day 180, embedding security advocates across core product lines to champion secure development practices. First 12 Months: Systemic Security Advancements and "Paved Roads" - Systemic Architecture Enhancements: Conduct comprehensive reviews of the production environment (including Kubernetes and containerized applications) to systematically address complex architectural security opportunities and build long-term environment resilience. - Standardizing "Paved Road" Configurations: Define, document, and roll out standardized, secure "paved road" configurations and guardrails, making secure deployment the friction-free path of least resistance for product teams. - Program Scaling & Mentorship: Maintain and scale updated product architecture documentation while continuously elevating team capabilities, autonomy, and cross-functional alignment through active, hands-on mentorship. Benefits and Compensation listed vary based on the location of your employment and the nature of your employment with SailPoint. As a part of the total compensation package, this role may be eligible for the SailPoint Corporate Bonus Plan or a role-specific commission, along with potential eligibility for equity participation. SailPoint maintains broad salary ranges for its roles to account for variations in knowledge, skills, experience, market conditions and locations, as well as reflect SailPoint’s differing products, industries, and lines of business. Candidates are typically placed into the range based on the preceding factors as well as internal peer equity. We estimate the base salary, for US-based employees, will be in this range from (min-mid-max, USD): $174,200 - $293,702.00Base salaries for employees based in other locations are competitive for the employee’s home location. Benefits Overview 1. Health and wellness coverage: Medical, dental, and vision insurance 2. Disability coverage: Short-term and long-term disability 3. Life protection: Life insurance and Accidental Death & Dismemberment (AD&D) 4. Additional life coverage options: Supplemental life insurance for employees, spouses, and children 5. Flexible spending accounts for health care, and dependent care; limited purpose flexible spending account 6. Financial security: 401(k) Savings and Investment Plan with company matching 7. Time off benefits: Flexible vacation policy 8. Holidays: 8 paid holidays annually 9. Sick leave 10. Parental support: Paid parental leave 11. Employee Assistance Program (EAP) and Care Counselors 12. Voluntary benefits: Legal Assistance, Critical Illness, Accident, Hospital Indemnity and Pet Insurance options 13. Health Savings Account (HSA) with employer contribution SailPoint is an equal opportunity employer and we welcome all qualified candidates to apply to join our team. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other category protected by applicable law. Alternative methods of applying for employment are available to individuals unable to submit an application through this site because of a disability. Contact applicationassistance@sailpoint.com or mail to 11120 Four Points Dr, Suite 100, Austin, TX 78726, to discuss reasonable accommodations. NOTE: Any unsolicited resumes sent by candidates or agencies to this email will not be considered for current openings at SailPoint.

Role Description GovCIO is currently hiring for an Identity and Access Management (IAM) Specialist to support enterprise identity, authentication, and access management services across cloud and SaaS environments. This position is responsible for designing and supporting enterprise identity solutions, integrating applications with Identity Providers (IdPs), implementing secure authentication frameworks, and establishing access governance policies. The IAM Specialist works closely with cybersecurity, infrastructure, application, and compliance teams to ensure secure, compliant, and scalable identity management solutions. This position will be fully remote within the United States. - Support the design, implementation, and administration of enterprise identity and access management solutions. - Establish secure authentication and authorization frameworks. - Integrate enterprise applications with identity services. - Support compliance with organizational security requirements. - Design and implement enterprise Identity and Access Management (IAM) solutions across cloud and SaaS environments. - Integrate applications with enterprise Identity Providers (IdPs) to support Single Sign-On (SSO), Multi-Factor Authentication (MFA), and identity lifecycle management. - Develop and maintain role-based access control (RBAC) models and access governance processes. - Collaborate with infrastructure, cybersecurity, and application teams to implement secure authentication and authorization services. - Support security compliance initiatives by implementing identity-related controls and maintaining required documentation. - Assist with continuous monitoring, access reviews, and remediation activities to support regulatory compliance. - Utilize SIEM platforms and log analysis tools to support identity-related monitoring, troubleshooting, and security investigations. - Develop technical documentation, implementation procedures, and operational guidance for IAM services. - Serve as a liaison between technical teams and security stakeholders to support secure identity management practices. Qualifications - Bachelor's with 0 - 2 years (or commensurate experience) - Experience designing and implementing enterprise Identity and Access Management (IAM) solutions. - Experience integrating applications with Identity Providers (IdPs) and supporting Single Sign-On (SSO) and Multi-Factor Authentication (MFA). - Experience implementing role-based access control (RBAC) and identity governance processes. - Knowledge of identity lifecycle management and enterprise authentication technologies. - Experience supporting security compliance, access reviews, and audit activities. - Familiarity with SIEM platforms such as Splunk, ELK Stack, or Microsoft Sentinel. - Understanding of log analysis, security event monitoring, and incident investigation. - Strong analytical, problem-solving, and communication skills. Requirements - Clearance Required: Preferred Skills and Experience - Experience supporting AWS, Azure, or other cloud environments. - Familiarity with NIST SP 800-53, Zero Trust Architecture, and federal cybersecurity requirements. - Experience with Microsoft Entra ID (Azure AD), Okta, SailPoint, Ping Identity, CyberArk, or similar IAM platforms. - Direct experience supporting the Department of Veterans Affairs. Posted Salary Range USD $70,000.00 - USD $80,000.00 /Yr.

• Technical owner of the information security operations platform, responsible for the architecture, strategy, and maintenance of detection controls, incident response, vulnerability management, identity management, and perimeter governance. • Primary technical reference for the area, contributing to the evolution of process maturity and the technical development of the team.

Role Description Dragos is on a relentless mission to defend industrial organizations that provide us with the necessities of modern civilization; running water, functioning electricity, and safe industrial working environments. As the market leader in ICS/OT Cybersecurity, we are dedicated to arming our customers with best-in-class technology, threat intelligence, and services to protect their systems as effectively and efficiently as possible. We’re a remote-first culture with operations in North America, Europe, the Middle East, and APAC. We’re looking for mission-oriented teammates who embody our core values of authenticity, transparency, and trust. Are you ready to make a difference? Come join a mission that can save the world! The Senior Security Endpoint Engineer owns the full lifecycle of endpoint security and management across Dragos. This is a dual-mandate role: you're responsible for keeping endpoints secure and for making sure people can actually do their jobs. That means EDR coverage and detection fidelity matter just as much as patch compliance and deployment reliability — and staff experience is a first-class outcome alongside security posture. You'll operate at the intersection of security engineering and IT operations, collaborating closely with Infrastructure/Systems Engineering to ensure unified endpoint management doesn't create friction for the business. This isn't a pure security role — it owns the employee-facing endpoint experience end to end. Responsibilities - Own the complete endpoint lifecycle including provisioning, configuration, enrollment, refresh, and decommissioning across all supported platforms while maintaining standard build configurations and baseline images. - Administer and optimize the endpoint detection and response (EDR) platform, including sensor deployment, detection tuning, and response policy optimization to reduce alert noise while preserving security effectiveness. - Lead endpoint-focused incident response activities including triage, containment, forensic data collection, and post-incident review; develop and maintain incident response runbooks for endpoint threat scenarios. - Establish and manage the endpoint patching program across operating systems and third-party software, define patch compliance SLAs by severity level, and coordinate patching efforts with Infrastructure and Systems Engineering teams. - Administer the mobile device management (MDM) platform for corporate and BYOD devices, manage mobile configuration profiles, compliance policies, and ensure mobile endpoint visibility within security tooling. - Act as the escalation point for complex endpoint issues beyond helpdesk capability, maintain user-facing documentation and guidance, and gather staff feedback to reduce unnecessary policy burden while preserving security controls. - Build and maintain endpoint automation for configuration management, compliance verification, remediation workflows, and reporting; evaluate new endpoint tools and capabilities and contribute endpoint-focused priorities to the security engineering roadmap. Qualifications - 5–8 years of hands-on experience in endpoint security, endpoint management, or a combined security/IT operations role. - Deep working knowledge of EDR platforms: deployment, tuning, policy management, and incident response workflows. - Demonstrated experience managing endpoints across Windows, macOS, and Linux at scale. - Hands-on MDM administration experience (corporate devices and/or BYOD) across iOS and Android. - Practical experience with patch management programs including SLA definition, compliance tracking, and exception handling. - Proficiency with scripting and automation (PowerShell, Bash, Python, or equivalent) for endpoint management and operational workflows. - Familiarity with vulnerability management workflows and how endpoint patching integrates into the broader program. - Strong written communication skills — you can document a configuration decision and explain a security risk to a non-technical audience without losing accuracy in either case. Requirements - Salary: $130,000 - Competitive Equity Package - Comprehensive Benefits Plan Company Description Dragos is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics, or any other basis forbidden under federal, state, or local laws. All new hires must pass a background check as a condition of employment.