Why This Job is Featured on The SaaS Jobs
Security roles in SaaS increasingly sit inside product engineering rather than operating as a separate review function, and this listing reflects that shift. Gong’s platform processes customer conversation data and delivers AI-driven capabilities, which makes identity, access control, and data-flow security central to the product experience. The scope spans cloud-native services and production systems, aligning with how modern SaaS companies ship and operate software at scale.
For a SaaS security career, the value here is exposure to security as an engineering discipline: influencing architecture decisions, embedding controls into CI/CD, and improving signal quality from automated tooling. Work across Kubernetes, IAM, supply chain risk, and vulnerability management builds a portfolio that transfers well across SaaS companies where reliability and trust depend on secure defaults. The inclusion of AI/ML feature security also supports relevance as more SaaS products incorporate model-driven workflows.
This role fits an engineer who prefers hands-on problem solving and collaborative influence over policy-heavy gatekeeping. It will suit someone comfortable moving between code, infrastructure, and developer workflows, and who wants responsibility for practical outcomes in production. Candidates interested in bridging application security with cloud and platform concerns should find the remit aligned with that trajectory.
The section above is editorial commentary from The SaaS Jobs, provided to help SaaS professionals understand the role in a broader industry context.
Job Description
About Gong
At Gong, we’re transforming customer-facing teams with our AI-powered platform that understands conversations, guides sales professionals, and drives better business outcomes. Security and trust are foundational to everything we build.
As a Senior Product Security Engineer, you will help shape how security is built, not just how it is tested or reviewed. You’ll work closely with engineering teams to secure real systems in production, influencing how services, APIs, and data flows are implemented from the ground up.
This is a hands-on role, focused on solving real security problems across cloud-native architectures and AI-driven features. You’ll work directly with developers and DevOps, dive into systems when needed, and apply strong technical judgment to ensure security is built into the product, not added later.
What Makes This Role Unique at Gong
- A product where data sensitivity is real, not theoretical
Gong processes and analyzes customer conversations at scale, creating unique challenges around data protection, privacy, and access control.
- AI is deeply embedded in the product
Security challenges extend beyond traditional AppSec into data handling, model behavior, and misuse scenarios.
- Security is part of how we build, not a layer on top
The role operates within engineering workflows, focusing on building secure systems rather than enforcing external controls.
- Meaningful scale and real production impact
You’ll work on systems that handle large volumes of data and traffic, where security decisions directly affect reliability and trust.
- A culture that values practical, engineering-driven security
The focus is on solving real problems and enabling teams, not on process-heavy or compliance-driven approaches.
- High ownership with room to grow
You’ll have the autonomy to take initiative, drive improvements, and expand your impact as the platform evolves.
What You’ll Do
- Secure real product flows end-to-end - Work directly with engineers to identify and fix vulnerabilities across services, APIs, and data paths in production systems
- Drive secure-by-design practices in engineering - provide practical guidance on authentication, authorization, data protection, and service-to-service communication
- Secure cloud-native environments - strengthen identity (IAM), isolation, and access control across Kubernetes, containers, and cloud infrastructure
- Build and scale security in the development lifecycle - integrate and tune security tooling (SAST, SCA, IaC scanning, secrets detection) into CI/CD pipelines to improve signal and developer adoption
- Own vulnerability management as a system - prioritize risks, drive remediation with engineering teams, and eliminate recurring issues through root-cause fixes
- Strengthen software supply chain security - reduce risk across dependencies, third-party components, and build/release pipelines
- Secure AI/ML-driven features - partner with data and AI teams to mitigate risks such as data exposure, misuse, and model-related vulnerabilities
- Raise the security bar across engineering - mentor developers and help teams take ownership of security in their code and services
- Enable fast, informed decisions - clearly communicate risks and trade-offs to support product and engineering velocity
What You Bring
- 5+ years of experience in Product Security, Application Security, or a similar hands-on security engineering role
- Proven experience working closely with engineering teams on real systems in production, not just assessments
- Strong understanding of secure design and threat modeling, with the ability to influence architecture decisions
- Deep knowledge of application security principles (OWASP Top 10 and beyond), including modern attack vectors
- Hands-on experience securing web applications, APIs, and distributed systems
- Strong experience with cloud environments (AWS, GCP, and/or Azure), including identity and access management (IAM)
- Familiarity with Kubernetes, containers, and cloud-native architectures
- Experience integrating security into CI/CD pipelines and improving developer workflows
- Practical experience with security tooling (SAST, SCA, IaC scanning, secrets detection), including tuning and operationalizing
- Experience working with modern development stacks (e.g., Java, Python, JavaScript/TypeScript, React or similar)
- Strong problem-solving skills and the ability to analyze complex systems and prioritize meaningful risks
- Ability to influence developers through technical credibility and practical guidance
- Experience mentoring engineers and improving security practices across teams
Additional strengths:
- Experience securing AI/ML or LLM-based systems
- Background in offensive security/penetration testing
