[Remote] Product Security Engineer

Note: The job is a remote job and is open to candidates in USA. Doppel is a rapidly growing Series C startup focused on social engineering defense using AI-native technology. They are seeking a Product Security Engineer to support and scale their product and cloud security efforts, collaborating closely with engineering teams to conduct architecture reviews, facilitate threat modeling, and manage penetration testing engagements.ResponsibilitiesPartner with product and engineering teams to support security architecture reviews for product features and the GCP environment; facilitate threat modeling and document risks, existing controls, and actionable recommendationsCoordinate and support penetration testing engagements by assisting with vendor selection and scoping, establishing rules of engagement, coordinating testing activities, validating findings, supporting severity assessment, and tracking remediation and retesting in collaboration with engineering teamsServe as a GCP security subject matter expert for project teams, advising on secure patterns across networking (VPC, private access, perimeter controls), data protection (KMS, secrets), compute runtimes (GKE, Cloud Run, GCE), CI/CD (Cloud Build, Artifact Registry), and logging and monitoringSupport the implementation and ongoing improvement of least-privilege IAM in GCP by advising on role design (custom vs. predefined), service account lifecycle management, workload identity, IAM Conditions, organization and folder policy constraints, and periodic access reviewsAssist with triage and routing of product security findings to appropriate engineering owners; help tune detection rules to reduce noise, support severity and SLA definition, and track remediation progress, including documenting justified exceptionsContribute to security guardrails through policy and infrastructure-as-code (e.g., org policies, constraints, reusable Terraform modules, admission or policy controllers) and support integration of pre-merge security checks into CI/CD workflowsDevelop and maintain practical documentation and runbooks (e.g., design review checklists, IAM standards, exception processes) and deliver targeted enablement sessions for engineers and product managersProvide visibility into progress and risk through metrics and regular status updates to security leadership; proactively surface blockers and suggest options and tradeoffsCoach and mentor engineers and code owners on secure-by-default coding practices and architectural patternsSkills5–7 years of experience in product security, cloud security engineering, or a related fieldStrong knowledge of Google Cloud Platform (GCP) services and security best practices, including IAM, networking, data protection, and workload runtimesHands-on experience with penetration testing coordination, threat modeling, and risk assessmentDemonstrated proficiency in Python and cloud-native programming or scripting languages to design and maintain security automation, policy enforcement, and continuous compliance controls using Infrastructure as CodeFamiliarity with designing and enforcing least-privilege IAM and conducting access reviewsAbility to communicate security risks and recommendations clearly to engineering and leadership audiencesBenefitsMeaningful equity so you share in Doppel’s successRemote first culture with flexibility built inFlexible PTO, comprehensive health benefits, parental leave, and moreCompany OverviewDoppel is an AI-native security platform that helps organizations defend against social engineering risks and digital impersonation. It was founded in 2022, and is headquartered in Covina, California, USA, with a workforce of 201-500 employees. Its website is https://www.doppel.com.Company H1B SponsorshipDoppel has a track record of offering H1B sponsorships, with 2 in 2026, 2 in 2025, 3 in 2024, 1 in 2023. Please note that this does not guarantee sponsorship for this specific role.