Sr. Product Security Engineer

We are looking for a practitioner with demonstrated experience and a proven track record in product or application security. The right person has done this work as a core responsibility, not a secondary one, and can speak with authority about what they have assessed, what they found, and how they helped the business respond.

Demonstrated hands-on experience in product security or application security, with a track record of conducting thorough security assessments of cloud-hosted applications and APIs. We are looking for people who have owned engagements.

A strong foundation in how web applications and APIs fail from a security standpoint, including the classes of weakness covered by the OWASP Top 10 and OWASP API Security Top 10, and the judgment to recognize when those frameworks apply and when they require adaptation.

Experience assessing modern identity and access control implementations, including OAuth2/OIDC, SAML, and JWT, at both the design level and the implementation level.

The ability to write proof-of-concept code to demonstrate the real-world impact of a finding, supported by enough scripting ability to extend and automate your own assessment work.

Working knowledge of cloud-hosted architectures, microservices, and container-based deployments, with the ability to reason about where security assumptions are most likely to hold and where they are most likely to fail.

Strong written and verbal communication skills, including the ability to produce clear, well-reasoned assessment reports for a technical audience.

The ability to build effective working relationships with engineering and product teams, including the confidence to advocate for a different course when the risk warrants it.

Bachelor's degree in Computer Science, Engineering, Information Security, or a related field, or equivalent practical experience.

Every strong candidate brings something the job description did not anticipate. The following are examples of experience that would be differentiating in this role, but they are not the full picture. If you have depth in an area that is not listed here and believe it is relevant, we want to hear about it.

Experience assessing AI-enabled products in production, including LLM integrations, retrieval augmented generation systems, agents, tool calling, and model endpoints. This is an emerging and strategically important area for Xylem's portfolio, and the ability to assess it rigorously is a meaningful differentiator.

Familiarity with emerging AI security frameworks and guidance, including the OWASP Top 10 for LLM Applications, the NIST AI Risk Management Framework, and MITRE ATLAS, applied critically rather than as a checklist.

Strong automation, scripting, or development capability beyond the basics. If you build tools to extend your own assessments, automate repeatable work, or prototype solutions because nothing off the shelf fits the problem, that is the kind of initiative we want to know about.

Experience with embedded systems, IoT, firmware analysis, or hardware-adjacent attack surface assessment. Xylem's product portfolio extends well below the application layer, and the ability to work lower in the stack adds real value.

Experience with threat modeling methods such as STRIDE and integrating security thinking into software development at the design stage.

Experience communicating security risk to diverse stakeholders, including product leadership and non-technical audiences, in ways that support informed decision-making.

Relevant certifications such as OSCP, GWAPT, GWEB, or equivalent that reflect a commitment to the craft .

Xylem's Global Product Security Engineering team functions as a trusted resource to the business. We are embedded in the product development process, not adjacent to it. We spend as much time understanding what we are assessing as conducting the assessment itself, because context is what makes the output useful to the people acting on it.

The team works across a portfolio that spans cloud-hosted SaaS platforms, embedded and connected devices, and AI-enabled products. No two engagements are the same. The problems are real, the business context matters, and the decisions we inform have direct consequences for systems that communities and operators depend on.

We invest in the growth of our team. That includes access to training, support for professional development, and the opportunity to build expertise in areas that are shaping the future of the field. As AI security, embedded systems testing, and application security continue to evolve, we want people who are engaged with that evolution and motivated to stay at its edge.

Join the global Xylem team to be a part of innovative technology solutions transforming water usage, conservation, and re-use. Our products impact public utilities, industrial sectors, residential areas, and commercial buildings, with a commitment to providing smart metering, network technologies, and advanced analytics for water, electric, and gas utilities. Partner with us in creating a world where water challenges are met with ingenuity and dedication; where we recognize the power of inclusion and belonging in driving innovation and allowing us to compete more effectively around the world.