Meaningful work in product security.
The Guild brings together specialists in product security leadership, engineering, testing, regulation, operations, and training to support connected and safety-critical products.
No open roles right now.
When a position opens, we will publish the responsibilities, required experience, working arrangement, engagement type, location limits, and application process here.
Security is our craft. The product is the point.
Product security is not one test, tool, or document. It is the work of understanding how a product is built, how it can fail, what evidence a decision requires, and what happens after the product leaves the lab.
The Guild supports the people who make critical products and the organizations that depend on them. That can mean shaping a Secure Product Development Framework, reviewing an architecture, building a threat model, testing an attack surface, preparing defensible regulatory evidence, assessing a supplier's SBOM, or helping a team respond when a fielded product cannot simply be switched off.
Different specialties. One standard.
Go deep without losing the system
Strong specialists know their craft. Strong product security practitioners also understand how their work affects safety, quality, regulation, operations, customers, and the next person in the lifecycle.
Separate evidence from assumption
We value people who can explain what they found, how they found it, what remains uncertain, and what the evidence supports. Precision matters more than performance.
Make the work usable
A finding, threat model, test result, or risk decision has to help someone act. Good work is technically sound, clearly communicated, and built for the people who must use it.
Respect real constraints
Safety-critical and regulated products come with legacy components, long support periods, operating dependencies, quality systems, and deadlines set by law. The right answer has to work in the real environment.
Share the craft
A guild gets stronger when knowledge moves. We value people who teach clearly, ask good questions, document what matters, and help teammates improve without turning expertise into theater.
Act with integrity
Say what is known. Say what is not. Protect the information entrusted to you, and do not claim more than the work can prove.
The disciplines we may need next.
The list below describes areas in which the Guild may grow. It is not a list of current vacancies.
- Product security leadership, governance, and program development.
- Systems security engineering and cybersecurity risk management.
- Software, mobile, web, cloud, and AI security.
- Embedded systems, firmware, hardware, RF, and wireless security.
- Threat modeling, security architecture, and requirements engineering.
- Penetration testing, attack-surface analysis, fuzzing, protocol testing, and control verification.
- SBOM, third-party software, vulnerability, and postmarket security management.
- Product-security incident readiness, investigation, and recovery.
- Quality-system, regulatory, and conformity-assessment support.
- Security-informed product procurement, deployment, and lifecycle management.
- Technical training, facilitation, research, and communication.
We are interested in depth, but we do not expect every practitioner to cover every item. The point of a guild is to bring different crafts together.
Product security needs different kinds of thinkers.
Relevant experience can come through engineering, product development, security research, quality, regulation, operations, incident response, testing, procurement, safety, technical education, or another discipline that touches the product lifecycle.
Depth matters. So do judgment, curiosity, clear communication, and respect for the people who must act on your work.
Interested in the Guild's future?
You may send a brief introduction and a link to your public professional profile to careers@prodsecguild.com. Please wait to send a full résumé or work samples until we request them.
Introduce YourselfDo not send confidential client information, proprietary code, security findings, regulated data, or sensitive work product. We cannot promise an immediate opportunity or retain every introduction, but we will know where to look when the right role opens.
