Product Security Engineer

About the role

At Doppel, we focus on building a culture where people feel respected, supported, and trusted to do meaningful work. We value clarity, collaboration, and solving real problems for our customers and teammates. We're looking for a Product Security Engineer to support and scale our product and cloud security efforts by embedding into engineering workflows and serving as a subject matter expert for GCP. The role partners closely with engineering teams to conduct architecture reviews, facilitate threat modeling, and support penetration testing engagements from scoping through remediation. This position contributes to the design and implementation of least-privilege IAM, helps build and maintain security guardrails through policy and infrastructure-as-code, and ensures security issues are effectively triaged, tracked, and resolved in collaboration with stakeholders. In addition to hands-on execution, the role emphasizes enablement providing guidance, documentation, and mentorship to engineers, along with clear communication and reporting to security leadership. This role is open remotely across the U.S. and Canada.

Responsibilities

• Partner with product and engineering teams to support security architecture reviews for product features and the GCP environment; facilitate threat modeling and document risks, existing controls, and actionable recommendations.
• Serve as a GCP security subject matter expert for project teams, advising on secure patterns across networking (VPC, private access, perimeter controls), data protection (KMS, secrets), compute runtimes (GKE, Cloud Run, GCE), CI/CD (Cloud Build, Artifact Registry), and logging and monitoring.
• Support the implementation and ongoing improvement of least-privilege IAM in GCP by advising on role design (custom vs. predefined), service account lifecycle management, workload identity, IAM Conditions, organization and folder policy constraints, and periodic access reviews.
• Assist with triage and routing of product security findings to appropriate engineering owners; help tune detection rules to reduce noise, support severity and SLA definition, and track remediation progress, including documenting justified exceptions.
• Contribute to security guardrails through policy and infrastructure-as-code (e.g., org policies, constraints, reusable Terraform modules, admission or policy controllers) and support integration of pre-merge security checks into CI/CD workflows.
• Develop and maintain practical documentation and runbooks (e.g., design review checklists, IAM standards, exception processes) and deliver targeted enablement sessions for engineers and product managers.
• Provide visibility into progress and risk through metrics and regular status updates to security leadership; proactively surface blockers and suggest options and tradeoffs.
• Coach and mentor engineers and code owners on secure-by-default coding practices and architectural patterns.

Requirements

• 5-7 years of experience in product security, cloud security engineering, or a related field.
• Strong knowledge of Google Cloud Platform (GCP) services and security best practices, including IAM, networking, data protection, and workload runtimes.
• Hands-on experience with penetration testing coordination, threat modeling, and risk assessment.
• Demonstrated proficiency in Python and cloud-native programming or scripting languages to design and maintain security automation, policy enforcement, and continuous compliance controls using Infrastructure as Code.
• Familiarity with designing and enforcing least-privilege IAM and conducting access reviews.
• Ability to

Benefits

Additional Information

About Doppel Doppel is building the future of social engineering defense. Our AI-native platform uses agentic AI to protect executives, employees, customers, and brands from phishing, impersonation, fraud, and other AI-powered threats across digital channels. We help some of the world's most recognized brands detect and dismantle attacker infrastructure while strengthening employee resilience through threat-informed training and simulation. By unifying Digital Risk Protection, Human Risk Management and Email Security, Doppel connects threats into a real-time intelligence graph to power faster disruption, smarter defense, and modern security awareness at scale. Backed by leading investors including Andreessen Horowitz and Bessemer Venture Partners, and trusted by leading enterprises, Doppel is a rapidly growing Series C startup building the future of social engineering defense. Our team combines deep cybersecurity expertise, operational rigor, and startup velocity to solve some of the internet's most urgent trust and safety challenges.

Your Match

How well this role fits your profile.

Company Intel

What employees say

Worked at Doppel? Share your experience