Description
As a Senior Product Security Engineer at PayPal, you'll help secure 439M accounts and $1.8T in annual payment volume by designing, building, and operating automated security scanners and developer guardrails across the software development lifecycle.
You'll partner with engineering, platform, and security teams to identify and reduce risk across source code, open source dependencies, secrets, software supply chains, AI/LLM tools, and other developer workflows.
The team's mission is to make secure development the easiest path for engineers, building scanners and guardrails that catch risk before software reaches production , spanning source code, dependencies, supply chains, AI/LLM tools, edge/CDN environments, and developer workflows.
Responsibilities:
- Independently apply security best practices to enhance and optimize systems, ensuring robust protection and efficiency
- Partner with peers and internal teams to drive security initiatives and contribute to cross-functional projects
- Analyze and resolve security challenges by adapting standard processes and exploring alternative approaches
- Influence the quality, efficiency, and effectiveness of the team through informed decision-making
- Collaborate with other engineers to gather and incorporate feedback, driving continuous improvements in security processes
Requirements:
- 3+ years relevant experience and a Bachelor’s degree OR Any equivalent combination of education and experience
Preferred Qualifications:
- Experience with SLSA, software bills of materials (SBOMs), provenance, artifact signing or verification, package repositories, or dependency governance
- Experience creating or tuning rules for static analysis, secrets detection, or policy-as-code systems
- Familiarity with security considerations for AI/LLM development tools, AI-assisted coding, or model and tool supply chains
- Experience with GCP, complemented by hands-on expertise with Kubernetes, Terraform, and other cloud-native technologies
- Familiarity in other programming and scripting languages, such as Java and Javascript, with the ability to troubleshoot code
- Experience using telemetry and metrics to improve security tooling at scale, including coverage, quality, performance, adoption, or remediation outcomes