Product Security Engineer IV

• Participate in planning, grooming, and design sessions for assigned product teams; contribute to security discussions.
• Contribute to threat models and risk registers for assigned products; document findings clearly and escalate issues to leadership as needed.
• Conduct vulnerability assessments on assigned products; apply exploitability frameworks to support accurate risk prioritization.
• Apply CB's security policies, audit requirements (SOC 2, ISO 27002, PCI, PII), and GRC standards - with guidance - to support compliance activities.
• Review code and security design documentation; identify security issues and contribute feedback in design reviews.
• Support remediation of security gaps in assigned products; track and report progress against Product Security Framework requirements.

• Participate in security training sessions; help product engineers apply secure coding practices, including responsible use of AI coding tools.
• Support the Product Security Partners program by contributing to security champion activities in assigned product teams.
• Document security learnings and patterns; contribute to the team's shared knowledge base.
• Invest in developing your security expertise: learn from industry advancement, attend team learning events, apply new skills in your daily work, and contribute to Hackathons.

• Operate and monitor assigned security tooling across cloud environments; support the integration of security controls into CI/CD pipelines.
• Contribute to security metrics tracking and reporting; collect and organize data that measures partner team security posture.
• Participate in agile ceremonies; manage assigned stories and tasks with clear documentation and timely delivery.
• Serve as on-call first responder for security tooling your team owns; support the Information Security team on incident response.

• 4+ years of experience in product security, application security, cloud security, or software engineering with security responsibilities.
• Deep application security knowledge, including common vulnerability classes (OWASP Top 10), secure coding practices, and security testing.
• Solid experience with securing AWS Services, AWS Secure Architectures, Application Security and Cloud Applications, including Software Supply Chain and micro service architecture
• Familiarity with cloud environments (AWS preferred) and CI/CD pipelines; developing knowledge of how security controls integrate into software delivery.
• Familiarity with audit and compliance frameworks such as SOC 2, ISO 27002, PCI, and PII, and the ability to apply them with guidance to product teams.
• Experience reading and reviewing code; proficiency or active development of skills in JavaScript/TypeScript or Python is a plus.
• Clear, concise written and verbal communication; the ability to document findings and explain security concepts to technical peers.
• A growth mindset: you seek feedback, apply it, and invest actively in developing your security expertise.
• Spanish speaking proficiency is preferred for one of our openings, with the ability to hold technical conversations in Spanish to partner with colleagues in our Puerto Rico office; reading and writing Spanish are a plus.
• Ability to travel 2-5 times per year to College Board offices in New York, Reston, VA, or Puerto Rico.

• A passion for expanding educational and career opportunities and mission-driven work
• Curiosity and enthusiasm for emerging technologies, with a willingness to experiment with and adopt new AI-driven solutions and comfort with learning and applying new digital tools independently and proactively.
• Clear and concise communication skills, written and verbal
• A learner's mindset and a commitment to growth: welcoming diverse perspectives, giving and receiving timely, respectful feedback, and continuously improving through iterative learning and user input.
• A drive for impact and excellence: solving complex problems, making data-informed decisions, prioritizing what matters most, and continuously improving through learning, user input, and external benchmarking.
• A collaborative and empathetic approach: working across differences, fostering trust, and contributing to a culture of shared success
• Authorization to work in the United States

• Application review will begin immediately and will continue until the position is filled. This role is expected to accept applications for a minimum of 5 business days.
• While the hiring process may vary, it generally includes: resume and application submission, recruiter phone/video screen, hiring manager interview, performance exercise such as live coding, a panel interview, a conversation with leadership and reference checks.

What We Offer

At College Board, we offer more than a paycheck: we provide a meaningful career, a supportive team, and a comprehensive package designed to help you thrive. We're a self-sustaining nonprofit that believes in fair and competitive compensation grounded in your qualifications, experience, impact, and the market.

A Thoughtful Approach to Compensation

• The hiring range for this role is $140,000 to $151,000.
• Your exact salary will depend on your location, experience, and how your background compares to others in similar roles at the College Board.
• We aim to make our best offer upfront, rooted in fairness, transparency, and market data.
• We adjust salaries by location to ensure fairness, no matter where you live.

You'll have open, transparent conversations about compensation, benefits, and what it's like to work at College Board throughout your hiring process. Check out our careers page for more.

#LI-REMOTE #LI-AP1