ZipRecruiter

Log In

1

Product Security Code Review Engineer Jobs in Ohio

CBIZ, Inc.

Senior Product Security Engineer

Cleveland, OH · On-site

$112K - $154K/yr

Code Review & Vulnerability Management * Perform manual and tool-assisted secure code reviews ... platform engineering, with at least 4 years focused on product security, DevSecOps, or security ...

CBIZ

Senior Product Security Engineer

Independence, OH · Hybrid

... Product Security Engineer is a deeply technical, hands-on engineering and architect-level role ... Establish controls for AI-generated code review to ensure AI-assisted development does not bypass ...

CBIZ, Inc.

Senior Application Security Engineer

Cleveland, OH · On-site

$57.50 - $77/hr

... review production code as a peer to senior developers. * Mandatory experience working directly with ... Cloud security expertise across Microsoft Azure and AWS, including IAM, container security ...

next page

Showing results 1-20

All JobsProduct Security Code Review Engineer JobsProduct Security Code Review Engineer Jobs in Ohio

Product Security Code Review Engineer information

What are the key skills and qualifications needed to thrive as a product security code review engineer?

To thrive as a Product Security Code Review Engineer, you need a deep understanding of secure coding practices, software development lifecycles, and vulnerability assessment, typically backed by a degree in computer science or a related field. Familiarity with static and dynamic analysis tools, code review platforms, and certifications like CISSP or OSCP is highly valuable. Strong analytical thinking, attention to detail, and effective communication are crucial soft skills for explaining security findings and collaborating with development teams. These skills and qualities are vital to identify, communicate, and mitigate security risks in code, ensuring the overall resilience of software products.

What are some typical challenges faced by product security code review engineers when coordinating with development teams?

Product Security Code Review Engineers often encounter challenges in balancing security priorities with project timelines and developer workflows. Effective communication is essential, as engineers must clearly explain vulnerabilities and remediation steps to developers who may have varying levels of security expertise. Additionally, they need to ensure that security recommendations are practical and align with the product's architecture, all while fostering a collaborative environment rather than creating bottlenecks. Building strong relationships with development teams and understanding their processes helps streamline secure code adoption and continuous improvement.

What is the difference between Product Security Code Review Engineer vs Software Security Engineer?

AspectProduct Security Code Review EngineerSoftware Security Engineer
Primary FocusReviewing and analyzing source code for security vulnerabilities in productsDesigning and implementing security measures across software systems
Skills & CertificationsSecure coding, code review, security standards (e.g., OWASP), certifications like CSSLPSecurity architecture, threat modeling, secure coding, certifications like CISSP
Work EnvironmentCollaborates with development teams during product developmentWorks on system-wide security strategies and architecture
Industry UsageCommon in product-based companies, especially in tech and cybersecurityFound in organizations focusing on overall security infrastructure

While both roles focus on security, the Product Security Code Review Engineer primarily reviews source code for vulnerabilities in specific products, whereas the Software Security Engineer develops and implements security strategies across software systems. The roles often overlap but differ in scope and focus.

What is a product security code review engineer?

A Product Security Code Review Engineer is a cybersecurity professional responsible for analyzing and reviewing application source code to identify and mitigate security vulnerabilities. They work closely with development teams to ensure secure coding practices, review code for compliance with security standards, and recommend fixes for potential security issues. Their goal is to prevent security breaches by catching vulnerabilities early in the software development lifecycle.
What are popular job titles related to Product Security Code Review Engineer jobs in Ohio? For Product Security Code Review Engineer jobs in Ohio, the most frequently searched job titles are:
What job categories do people searching Product Security Code Review Engineer jobs in Ohio look for? The top searched job categories for Product Security Code Review Engineer jobs in Ohio are:
What cities in Ohio are hiring for Product Security Code Review Engineer jobs? Cities in Ohio with the most Product Security Code Review Engineer job openings:
Product Security Code Review Engineer jobs near you

Senior Product Security Engineer

CBIZ, Inc.

Cleveland, OH • On-site

$112K - $154K/yr

Full-time

Posted 11 days ago

CBIZ rating

8.0

Company rating: 8.0 out of 10

Based on 57 frontline employees who took The Breakroom Quiz

12th of 22 rated bookkeepers and accountants

Job description


#LI-CR2 #LI-Hybrid
Responsibilities
The Senior Product Security Engineer is a deeply technical, hands-on engineering and architect-level role responsible for establishing and leading the Product Security function at CBIZ. As the first dedicated hire in this domain, this position serves as the single point of accountability for product security across the enterprise - defining strategy, building the program from the ground up, and operating as a trusted architect and advisor to development, engineering, platform, and AI teams.
Operating within a matrix organization, the role champions a security-first mindset across business groups, embeds secure-by-design principles into the Software Development Lifecycle (SDLC), and leads the transformation to a mature Secure SDLC with a DevSecOps focus. The engineer acts as a guiding authority on secure coding, threat modeling, application architecture, AI/LLM security, and software supply chain integrity.
This role requires an experienced builder with a strong coding background, demonstrated AI security expertise, and the ability to influence without direct authority - operating as a credible technical peer to senior developers and AI engineers alike.
Essential Functions and Primary Duties
Product Security Strategy & Architecture
  • Define and own the enterprise Product Security strategy, roadmap, reference architectures, and secure design patterns for web, mobile, API, microservices, serverless, and AI-enabled applications.
  • Serve as the Product Security Architect for major initiatives, providing authoritative guidance on authentication, authorization, session management, encryption, key management, secrets handling, and API security.
  • Establish secure-by-design standards, control libraries, and engineering guardrails that scale across product lines and business units.

Secure SDLC & DevSecOps Enablement
  • Lead the transition from traditional SDLC to a mature Secure SDLC with embedded DevSecOps controls, integrating security gates into every phase including design, code, build, test, deploy, and operate.
  • Architect and operationalize security automation including SAST, DAST, SCA, container image scanning, and secrets detection.
  • Define vulnerability remediation of SLAs and drive measurable reduction in mean-time-to-remediate.
  • Build developer-friendly tooling, paved-road patterns, and self-service guardrails that enable engineering velocity without compromising security.

AI Security & AI Engineering Partnership
  • Act as the dedicated security partner to CBIZ's AI engineering team, reviewing AI/ML configurations, agent designs, model integrations, and deployment patterns to ensure they meet enterprise security and privacy standards.
  • Establish AI security best practices and guardrails for generative AI, agentic workflows, RAG pipelines, and LLM-powered applications, aligned to the OWASP Top 10 for LLM Applications including prompt injection, insecure output handling, training data poisoning, supply chain vulnerabilities, sensitive information disclosure, excessive agency, and model theft.
  • Review and harden AI model configurations, system prompts, tool and function calling permissions, content filters, rate limits, and identity boundaries for agents operating against enterprise data.
  • Establish controls for AI-generated code review to ensure AI-assisted development does not bypass secure SDLC checkpoints.
  • Define data protection and access controls for AI workloads including grounding data governance, vector database security, and PII handling prompts and responses.
  • Partner with AI engineers on model risk management, red-teaming, and adversarial testing.
  • Stay current with the evolving AI regulatory landscape (NIST AI RMF, EU AI Act, ISO/IEC 42001) and translate requirements into engineering controls.

Threat Modeling & Secure Design Reviews
  • Facilitate threat modeling sessions using STRIDE, PASTA, and MITRE ATLAS for AI/ML systems producing actionable mitigations and ranked risk registers.
  • Conduct architecture and design reviews to identify weaknesses before code is written, partnering with solution architects and engineering leads.

Code Review & Vulnerability Management
  • Perform manual and tool-assisted secure code reviews against OWASP Top 10, CWE Top 25, and SANS 25, providing remediation guidance with corrected code where appropriate.
  • Triage scanner findings and own application vulnerability management workflows, SLA tracking, and executive reporting on AppSec posture.

Software Supply Chain Security
  • Define and enforce controls for third-party and open-source components, dependency hygiene, SBOM generation, and signed artifacts, including AI model provenance and dataset integrity.
  • Harden source repositories, build systems, and deployment environments against supply chain compromise.

Matrix Leadership & Security Mindset Advocacy
  • Navigate CBIZ's matrix organization to influence development, engineering, AI, platform, and product teams.
  • Act as the visible, accessible point of contact for application security, embedding into engineering rituals such as design reviews, architecture councils, and sprint planning.
  • Lead developer enablement programs including secure coding training, threat modeling workshops, a security champions network, and lunch-and-learn sessions across business groups.

Incident Response & Executive Reporting
  • Serve as the AppSec and AI security subject matter expert during incident response, escalations, and post-incident reviews.
  • Produce board-ready and executive-level reporting on AppSec maturity, AI security posture, key risk indicators, and program outcomes.

Preferred Qualifications
  • 8+ years of progressive experience in software engineering, application development, or platform engineering, with at least 4 years focused on product security, DevSecOps, or security architecture.
  • Mandatory hands-on coding background with proficiency in one or more modern languages such as Python, Java, C#/.NET, JavaScript/TypeScript, or Go, and the demonstrated ability to read, write, and review production code as a peer to senior developers.
  • Mandatory experience working directly with development, engineering, and AI/ML teams within a matrix environment.
  • Mandatory hands-on AI security experience, including reviewing AI/ML system architectures, securing LLM integrations, evaluating model configurations, and applying frameworks such as OWASP Top 10 for LLMs, MITRE ATLAS, and the NIST AI Risk Management Framework.
  • Deep expertise in Secure SDLC, OWASP Top 10, CWE Top 25, MITRE ATT&CK, and CVSS.
  • Hands-on experience with AppSec tooling such as SAST (Semgrep, CodeQL, SonarQube, Checkmarx, Veracode), DAST (Burp Suite, OWASP ZAP), SCA (Snyk, Black Duck), IaC scanning, and secrets detection.
  • Strong understanding of CI/CD platforms including GitHub Actions, GitLab CI, Azure DevOps, and Jenkins, with experience hardening pipeline security.
  • Cloud security expertise across Microsoft Azure and AWS, including IAM, container security (Kubernetes), workload protection, and CNAPP platforms.
  • Familiarity with API security (REST, GraphQL), authentication and authorization standards (OAuth 2.0, OIDC, SAML), and modern cryptography.
  • Demonstrated ability to influence without authority and navigate a matrix organization across multiple business groups.

Qualifications
Minimum Qualifications
  • College Degree or equivalent required
  • 8 years related experience
  • Expert technical knowledge
  • Knowledge of industry regulations
  • Ability to lead and coordinate the team activities of others
  • Ability to formulate, document and recommend new policies and procedures
  • Able to work in and lead a team
  • Demonstrated ability to communicate verbally and in writing throughout all levels of an organization, both internally and externally
  • Ability to travel as required by business and on-call availability

About Us
CBIZ, Inc. (NYSE: CBZ) is a leading professional services advisor to middle-market businesses nationwide. With industry knowledge and expertise in accounting, tax, advisory, benefits, insurance, and technology, CBIZ delivers actionable insights to help clients anticipate what is next and discover new ways to accelerate growth. CBIZ has more than 9,500 team members across 23 major markets coast to coast.
CBIZ strives to be our team members' employer of choice by creating an environment where team members are appreciated, recognized for their contributions, and provided with opportunities to grow, both personally and professionally, throughout their careers.
Together, CBIZ and CBIZ CPAs are ranked as one of the top providers of accounting services in the United States. CBIZ CPAs is an independent CPA firm that provides audit, review and attest services, while CBIZ provides business consulting, tax and financial services. In certain jurisdictions, CBIZ CPAs operates under its previous name, Mayer Hoffman McCann P.C.

What CBIZ employees say

Pay

Benefits

Hours and flexibility

Workplace

Get the full story on Breakroom

CBIZ logo

About CBIZ

Sourced by ZipRecruiter

With over 100 offices and nearly 6,000 associates in major metropolitan areas and suburban cities throughout the U.S. CBIZ (NYSE: CBZ) delivers top-level financial and employee business services to organizations of all sizes, as well as individual clients, by providing national-caliber expertise combined with highly personalized service delivered at the local level.

Industry

Business management consulting

Company size

5,001 - 10,000 Employees

Headquarters location

Cleveland, OH, US

Year founded

1987

View All CBIZ Jobs

Apply