Product Security Engineer in Provo, UT. • Work with engineering teams to design and develop applications that incorporate security best principles. • Configure, monitor, and deploy monitoring and blocking rules on Qualtrics WAF interfaces. • Operate container security including image scanning, k8s security best practices, and container runtime security. • Analyze software applications for security vulnerabilities using manual and automated source code review tooling. • Identify security risks and weaknesses in software architecture by performing application threat modeling. • Use security testing tools to identify, track, and fix vulnerabilities in applications and enterprise infrastructure. • Maintain and generate reports on application and infrastructure security posture metrics, KPIs, and vulnerabilities to support enterprise and security architects. • Coordinate internal pen test engagements with the Qualtrics red team and Engineering stakeholders. • Collaborate with Engineering teams through multiple channels including application review sessions, threat modeling, and security champions program. • Own and operate the Qualtrics vulnerability disclosure and bug bounty programs. Requires a Bachelor's degree in Computer Science, Information Technology, Engineering, or a related field, plus 3 years of related work experience. Additionally, position requires experience with all of the following: 1. 3 years of experience with product security, secure application development, or cybersecurity. 2. 3 years of experience identifying and mitigating security issues in software and knowledge of secure code development best practices. 3. Any amount of experience with AWS security best practices including IaC, as it pertains to hardening a cloud-centric infrastructure. 4. Any amount of experience with Python, JavaScript, Ruby, or Go. 5. Any amount of experience using SAST, SCA, DAST, and CNAPP tools. 6. Any amount of experience securing CI/CD pipelines and secure configuration of version control systems. 7. Any amount of experience with application security frameworks including OWASP Top Ten. Must also have authority to work permanently in the U.S.