Product Security Engineer
About the job
- Experience shipping production code, either from software engineering or security work that includes coding.
- Experience with a multi-tenant SaaS platform's authorization and tenant-isolation model, and strong knowledge of automatically testing for broken object-level authorization.
- Ability to design API security end to end, including authentication, credential lifecycle, rate limiting, abuse resistance, and webhook security.
- Hands-on experience with threat-modeling methodologies such as STRIDE, translating identified threats into actionable engineering requirements and security tests.
- Practical experience implementing and tuning Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) tools in CI/CD workflows, with a focus on useful developer feedback and effective vulnerability remediation.
- Understanding of how AI features are built, including retrieval, context assembly, tool calling, and agent loops, and where indirect prompt injection can break multi-tenant isolation.
- Hands-on experience with Google Cloud security, Kubernetes, and tools such as Wiz and Datadog.
- Knowledge of building security monitoring and detections using in-house Security Information and Event Management (SIEM) tools, from designing signals through tuning them and writing runbooks.
- Strong knowledge of OWASP security guidance, including the OWASP Top 10, API Security Top 10, and Top 10 for Large Language Model Applications.
- Ability to influence engineers who do not report to you and to work early in a function without an existing playbook.
- Threat-model new product features before they are built, including AI-embedded features, and turn findings into engineering work.
- Own tenant isolation and API security across the Rule Engine, Integration API, Management API, CAMA, UCP Predict features, Talon.One MCP, and third-party integrations.
- Act as the security design authority for AI features, working closely with the team behind UCP and Predict.
- Build automated cross-tenant and adversarial testing that runs in CI so isolation is checked on every build.
- Build standard, frictionless, automated golden paths for code security checks in CI workflows that developers can adopt by default without slowing delivery.
- Run vulnerability management and coordinate patch response across squads outside Platform, from automated dependency updates to emergency response.
- Build and own application and AI security monitoring with observability tools; build real-time security detection rules, alerts, and security-event runbooks.
- Design the security of the API integration between Talon.One and Adyen as the products come together.
- Run a security champions program so all tribes build security capability.
- Experiment with AI and build workflows to identify, prioritize, and remediate product security risks at scale.
About the company
Talon.One provides an API-first, headless platform for enterprises to create, manage, and monitor promotions, loyalty programs, and gamification via the Incentives Engine. The platform integrates with a brand’s existing tech stack (CRM, e-commerce, POS) and uses a rules engine to personalize offers in real time based on customer data, geography, and behavior; it offers campaign management, coupon generation, referrals, loyalty logic, geofencing, and budget controls. Unlike many promo tools, it plugs into current systems without heavy coding and enables real-time data exchange across channels through its API. Talon.One serves mid-market to enterprise brands across retail, fintech, and hospitality (e.g., Adidas, H&M, Sephora) and aims to expand globally with AI-powered insights and predictive analytics following a 2025 growth round.
Company Size
201-500
Company Stage
Acquired
Total Funding
$138.3M
Headquarters
Berlin, Germany
Founded
2015
Get referred to Talon One
See people who can refer or advise you
Simplify's Take
What believers are saying
- The July 1, 2026 Adyen closing validates Talon.One’s enterprise incentives category.
- Adobe’s April 2026 integration expands Talon.One distribution across Real-Time CDP customers.
- January 2026 UIP positions Talon.One for agentic commerce before AI shopping protocols harden.
What critics are saying
- Adyen closed the €750 million deal July 1, 2026, ending Talon.One independence.
- Adyen can absorb Talon.One into its payments stack and sunset standalone product sales.
- Adobe, Salesforce, and SAP can bundle loyalty tools, crushing Talon.One’s pricing power by 2027.
What makes Talon One unique
- Talon.One’s API-first incentives engine runs promotions in real time across channels.
- Adobe Experience Platform now embeds Talon.One’s loyalty logic through a native connector.
- Unified Incentives Protocol targets AI shopping agents before competitors standardize machine-readable offers.
Help us improve and share your feedback! Did you find this helpful?
Benefits
- Health Insurance
- Dental Insurance
- Vision Insurance
- Life Insurance
- Disability Insurance
- Unlimited Paid Time Off
- Flexible Work Hours
- Remote Work Options
- Paid Vacation
- Paid Sick Leave
- Paid Holidays
- Sabbatical Leave