Product Security Engineer
About the role
H2O.ai is seeking a Product Security Engineer to join their Product Security Engineering team, focusing on scaling vulnerability management and security compliance operations for their cloud platform. The role involves managing vulnerability scanning and assessment, leading triage and analysis of security findings, coordinating and performing hands-on remediation, and building automation to optimize security workflows. The position supports compliance requirements for frameworks such as FedRAMP and SOC2, and involves cross-functional coordination with engineering teams. The ideal candidate will have strong coding skills, experience with container security, vulnerability management, and security scanning tools, as well as excellent communication and organizational abilities. The role is based in Sri Lanka and offers the opportunity to work with cutting-edge cloud-native technologies in a remote-friendly and flexible environment.
Must have
- 3+ years of software engineering experience.
- Strong coding skills in at least 2 languages (Python, JavaScript, Go, Ruby, Java, etc.)
- Comfortable reading, writing, debugging, and deploying code.
- Experience with dependency management (npm, pip, maven, bundler, etc.)
- CI/CD experience (GitHub Actions, GitLab CI, Jenkins, CircleCI, etc.)
- Git proficiency (branching, PRs, code review)
- Testing mindset (write and run tests to validate fixes)
- Strong understanding of container security, vulnerability management, and CVE assessment.
- Ability to analyze vulnerability findings deeply - understanding exploit paths, affected components, and contextual risk.
- Hands-on experience with security scanning tools (e.g Trivy, AWS Inspector, Aquasec).
- Familiarity with Kubernetes security concepts and best practices.
- Excellent written and verbal communication skills for cross-functional coordination with engineering teams.
- Strong follow-through and ability to drive remediation efforts across multiple teams.
- Detail-oriented mindset with ability to manage multiple priorities and deadlines.
- Customer-focused approach with ability to translate technical security findings into business context.
- Self-motivated and able to work effectively in a remote-first environment.
Nice to have
- Experience in application security, product security, or DevSecOps roles.
- Experience with compliance frameworks (FedRAMP, SOC2, ISO 27001, or banking regulations) preferred.
Technologies
- Ai
- Automation
- AWS
- CI/CD
- CircleCI
- Cloud
- Cloud Native
- Container Security
- DevSecOps
- FedRAMP
- Git
- GitHub
- GitHub Actions
- GitLab
- ISO 27001
- Java
- JavaScript
- Jenkins
- Kubernetes
- Machine Learning
- Maven
- npm
- Python
- Responsible AI
- Ruby
- SOC 2
- Vulnerability Scanning
Highlights
This position is based in Sri Lanka and supports a remote-friendly culture with flexible working arrangements. H2O.ai offers market-leading total rewards and opportunities for career growth. The company values diversity and inclusion and encourages applicants from all backgrounds. Application is open to all qualified candidates; visit the H2O.ai website for more information.
Jobs across Sri Lanka, watched for you.Colombo, Sri Lanka