Director of Product Security

Leads product security at WHOOP, building and running several engineering teams that secure the software serving WHOOP members. The remit covers the secure development lifecycle and the identity and authentication features that protect members; the director sets the roadmap with stakeholders across the business and staffs the function as engineering grows.

The teams handle member authentication, code security, cloud security across the company's AWS accounts, privacy by design and threat modelling. The director runs application vulnerability management across bug bounty reports and code, container and infrastructure findings, builds out developer security tooling such as SAST, SCA, container scanning, secrets detection and pipeline checks, and sets long-term strategy, architecture standards and secure development practice for product-facing systems. Close work with Product, Software, Legal, Compliance, the office of the CISO and enterprise security is expected, as is coaching engineering managers and senior individual contributors.

WHOOP is looking for someone who has scaled a security engineering organisation across multiple teams with well-defined domains, has grown engineers at staff level and above, and brings a strong software development background and deep product security knowledge spanning vulnerability management, privacy, threat modelling and secure-by-default patterns. AWS, containerised microservices, security incident response and automation for scanning or compliance checks are pluses. The role is on-site in Boston.