Product Security Engineer IV

Product Security Engineer IV College Board - Technology - Product Security Location: 1) This is a fully remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office). Type: This is a full-time position About the Team The College Board Product Security team is a close-knit and enthusiastic group of technologists with a thirst for knowledge in security and cloud. We collaborate closely to investigate and solve problems and have strong alignment with our product teams to be a step ahead in securing the organization's suite of products. We are an agile organization, embracing AI and cloud-native systems, and are focused on improving speed and security of service delivery in support of our important mission. Our team comes from a wide variety of backgrounds as well as experience within the security space and we work to ensure everyone on the team has a voice. Product Security Engineers work closely with Product teams as well as other organizational stakeholder groups to achieve product and security business objectives. They support threat modelling, architecture design, and implementation of secure development practices. In addition, they help define organizational security standards and organizational capability and tooling adoption decisions. About the Opportunity As a Product Security Engineer IV, you will work alongside other security engineers to support security across the development lifecycle for assigned College Board product teams. You will participate in threat modeling, vulnerability assessment, and design review-including for products that incorporate AI-powered features and use AI coding tools in development. You will build and apply your security knowledge on real work and document your findings clearly. Day-to-day, you will conduct security code reviews, operate assigned security tooling, and support the remediation of identified vulnerabilities. You will also contribute to the Product Security Partners program, helping product engineers understand and apply secure development practices. This is hands-on product security work with real stakes-your contributions help protect platforms that serve millions of students and educators worldwide. In this role, you will: Support Product Team Partnerships (55%) Participate in planning, grooming, and design sessions for assigned product teams; contribute to security discussions. Contribute to threat models and risk registers for assigned products; document findings clearly and escalate issues to leadership as needed. Conduct vulnerability assessments on assigned products; apply exploitability frameworks to support accurate risk prioritization. Apply CB's security policies, audit requirements (SOC 2, ISO 27002, PCI, PII), and GRC standards-with guidance-to support compliance activities. Review code and security design documentation; identify security issues and contribute feedback in design reviews. Support remediation of security gaps in assigned products; track and report progress against Product Security Framework requirements. Support the Product Security Program (20%) Participate in security training sessions; help product engineers apply secure coding practices, including responsible use of AI coding tools. Support the Product Security Partners program by contributing to security champion activities in assigned product teams. Document security learnings and patterns; contribute to the team's shared knowledge base. Invest in developing your security expertise: learn from industry advancement, attend team learning events, apply new skills in your daily work, and contribute to Hackathons. Contribute to Operational Improvement (25%) Operate and monitor assigned security tooling across cloud environments; support the integration of security controls into CI/CD pipelines. Contribute to security metrics tracking and reporting; collect and organize data that measures partner team security posture. Participate