Principal Product Security Engineer

Candescent is a forward-thinking technology company transforming how financial institutions deliver Intelligent Banking experiences. We unite digital banking, account opening, and branch solutions that power and connect digital banking, account opening, and branch solutions—creating seamless engagement across digital, remote, and in-person channels. Our Experience-Led, Intelligence-Driven approach combines human-centered design with data, automation, and cloud-based innovation. Built on an API-first architecture, our extensible ecosystem enables institutions to adapt quickly, integrate easily, and unlock new opportunities for growth—turning every customer interaction into a moment of clarity, confidence, and connection. Role Summary We are seeking a Principal Product Security Engineer to drive the security posture of Candescent’s applications and services throughout the entire Software Development Lifecycle (SDLC). This is a hands-on practitioner role designed for a senior security professional with a strong foundation in software development or engineering. In this role, you will champion a "shift-left" security culture, embedding core application security practices—including SAST, DAST, SCA, and secure coding standards—directly into modern CI/CD pipelines. Additionally, you will serve as the primary expert responsible for defining secure design patterns and governance for integrating third-party artificial intelligence and large language model (LLM) services across the enterprise. Key Responsibilities and Deliverables Core Product Security & Shift-Left Engineering Shift-Left Implementation: Partner closely with engineering teams to embed threat modeling, security architecture reviews, and automation early in the product development lifecycle. Pipeline Automation (SAST/DAST/SCA): Own the selection, integration, and tuning of Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) tools within automation pipelines. Vulnerability Management: Analyze tool outputs, filter out false positives, and collaborate directly with developers to provide actionable, prioritized remediation guidance. Secure Coding & Awareness: Define, maintain, and evangelize secure coding best practices based on OWASP Top 10 and real-world threat vectors; conduct technical code reviews and security mentorship for engineering teams. Secure AI Integration & Governance (Specialized Skill Set) Secure AI Architecture: Ability to define and maintain secure integration patterns for third-party AI and LLM services, focusing on API security, authentication, secrets management, and data-in-transit protections. Data Guardrails: Ability to establish and enforce input/output controls, prompt handling standards, and data classification guardrails for AI-enabled applications. Threat Mitigation: Ability to identify and mitigate AI-specific risks including prompt injection, model manipulation, data leakage…