Product Security Engineer
Who we are:
Action1 is an autonomous endpoint management platform trusted by many Fortune 500 companies. Cloud-native, infinitely scalable, highly secure, and configurable in minutes, it just works—and is always free for the first 200 endpoints, with no functional limitations. By pioneering autonomous OS and third-party patching, peer-to-peer patch distribution, and real-time vulnerability assessment without requiring a VPN, Action1 eliminates routine IT labor, helps prevent ransomware and other security risks, and protects the digital employee experience. In 2025, Action1 was recognized by the Inc. 5000 as the fastest-growing private software company in America. Action1 is founder-led by Alex Vovk and Mike Walters, entrepreneurs who previously founded Netwrix, a multibillion-dollar cybersecurity company.
The Role
We are looking for a Product Security Engineer to join the team responsible for securing Action1’s multi-tenant SaaS platform. In this role, you will work closely with engineering, product, and security teams to identify risks early, support vulnerability handling, strengthen secure development practices, and make product security practical, clear, and actionable. This is a hands-on role for someone who understands both software engineering and cybersecurity, enjoys working directly with developers, and wants to build security into the product without slowing teams down unnecessarily.
What you'll do:
- Support Product Security Incident Response Team (PSIRT) and vulnerability-handling activities
- Validate, triage, track, and coordinate security reports
- Provide practical remediation guidance to engineering teams
- Help validate security fixes and reduce product security risks
- Review code, APIs, and system architecture to identify security issues early
- Conduct threat modeling and security design reviews
- Improve security automation within engineering workflows
- Support SAST, SCA, secrets scanning, and other security controls
- Maintain software bills of materials (SBOMs), dependency visibility, and remediation follow-up
- Support security assessments, vulnerability assessments, and penetration testing
- Maintain vulnerability-handling playbooks, product security procedures, and incident response runbooks
