Product Security Engineer - DevSecOps

Product Security Engineer – Devsecops

About the Role

Adobe's Product and Software Security Team is seeking a Security Engineer with deep penetration testing expertise and a strong DevSecOps background to drive both hands-on Adversarial testing and the integration of security across Adobe's software development lifecycle. The role spans security assessments of web, mobile, and desktop applications, cloud environments, AI/LLM systems, and supporting infrastructure, alongside building and operating the security guardrails embedded into CI/CD pipelines.

The successful candidate will lead end-to-end engagements, deliver findings with clear risk assessments and actionable remediation, and partner with engineering teams to ship secure-by-default software at scale.

What You’ll Do
Conduct penetration tests on AI/LLM systems (prompt injection, model poisoning, jailbreaks, etc.), web applications, APIs, mobile apps, cloud infrastructure, containers, and supporting infrastructure.
Identify and exploit vulnerabilities including authentication/authorization flaws, business logic issues, injection, SSRF, deserialization, and chained attacks.
Embed security controls into CI/CD pipelines: SAST, DAST, SCA, secrets scanning, and container/image scanning as first-class pipeline gates.
Design and operate DevSecOps automation across cloud environments (AWS, Azure, GCP): policy-as-code, infrastructure-as-code scanning, and automated security guardrails.
Develop custom scripts and tooling using Python, Go, or PowerShell to automate testing, validation, and pipeline integration.
Partner with engineering teams on threat modeling, security code review, and secure-by-default architecture.
Build the feedback loop from security findings back into preventive controls so the same class of bug doesn't ship twice.
Deliver clear, actionable reports and provide remediation guidance to engineering and product teams.
Manage the full lifecycle of penetration testing engagements from scoping to execution and delivery.
Research emerging AI/ML exploits, cloud-native attack techniques, and supply chain risks to stay ahead of threats.
Enhance testing methodologies and contribute to the internal knowledge base.

Requirements
4+ years of combined experience in penetration testing and DevSecOps, with meaningful depth in both - not just one.
Hands-on pentest experience across web apps, APIs, mobile, and cloud environments. You can find and exploit, not just scan and report.