Head of Product Security — Job Description

Role snapshot

About Accops and the role

What you'll own

• Own the security design of authentication, session and token flows across gateway, clients and cloud: OAuth/OIDC, SAML, MFA, DPoP and proof-of-possession tokens, device binding.
• Design and review transport security: TLS configuration, mTLS between components and endpoints, certificate pinning and validation.
• Define how keys and secrets are generated, stored, rotated and revoked: HSM and TPM usage, vaults, key hierarchies, certificate lifecycle and internal PKI.
• Lead threat modelling for every new feature and architecture change; your sign-off is required before a security-critical design is built.
• Set secure coding standards and reusable secure components (crypto wrappers, input handling, safe library loading) that engineers actually adopt.

• Attack our own products as a real adversary would: white-box code review, reverse engineering, exploit development and end-to-end red team exercises.
• Hunt for memory-corruption bugs (buffer and heap overflows, use-after-free, integer and format-string bugs), logic flaws, auth bypasses and crypto misuse.
• Test client-side attack surfaces: DLL/shared-library hijacking and side-loading, privilege escalation, code injection, tampering, and abuse of local IPC and services.
• Write proof-of-concept exploits that show real impact, and work with engineers until the root cause is fixed, not just the symptom.
• Build fuzzing and targeted tooling for the parts of the code that matter most.

• Hire, mentor and lead a team of security researchers and testers; raise them from black-box testing to code-level and design-level work.
• Set the testing depth and release sign-off for each product: gateway, Windows/macOS/Linux/mobile clients, web portals and cloud services.

• Lead technical investigation of security incidents involving Accops products, in-house and at customer sites.
• Perform memory, disk, log and network forensics, including in-memory malware, injected code and fileless persistence; establish root cause, blast radius and timeline.
• Turn every incident into a design or code fix so the same class of bug does not recur.

• Be the trusted technical security voice of Accops with customer CISOs, security teams and their red teams.
• Explain vulnerabilities, fixes and incident root causes clearly to both engineers and executives, in writing and on calls.
• Handle tough conversations during incidents with calm, accuracy and transparency.

What you bring (must-have)

• 10+ years of experience, starting as a software engineer who designed and shipped production systems (Go and/or C/C++, plus Node.js, Angular, cloud microservices, Docker and Kubernetes), followed by 5+ years in offensive security research.
• Real red team experience: planned and executed adversary-style engagements against products or organisations, beyond scanner-driven VAPT.
• Strong grasp of software architecture and the ability to find security flaws in a design before code is written.
• Deep knowledge of authentication and token security: OAuth 2.0/OIDC, SAML, DPoP, token binding, replay and session-hijack defences.
• Hands-on expertise in TLS and mTLS, X.509 and PKI, certificate management and pinning.
• Practical experience with key management: HSMs, TPMs, secrets vaults (e.g. HashiCorp Vault, cloud KMS), envelope encryption and key rotation; knows how crypto is misused in real code.
• Proven ability to find and exploit memory-safety bugs and other vulnerability classes (OWASP and CWE Top 25), with exploit and PoC development skills.
• Understanding of OS internals relevant to endpoint attacks: process injection, library loading and hijacking, privilege escalation, in-memory malware techniques.
• Hands-on with reverse engineering and debugging tools (IDA Pro or Ghidra, WinDbg/GDB, Frida), Burp Suite and fuzzers (AFL++, libFuzzer).
• Incident forensics experience, including memory forensics (e.g. Volatility).
• Has led or mentored a team of security researchers.
• Clear, confident communicator in English with customer security teams and senior stakeholders.

What this role is not

• Not a governance, risk or compliance role: no policy writing, audit coordination or security questionnaires as core work.
• Not IT, SOC or infrastructure security management.
• Not a black-box VAPT role run from scanner output. We want someone who reads code, understands design and thinks like an attacker.

Nice to have

• Published CVEs, exploit write-ups, conference talks (e.g. Nullcon, c0c0n, DEF CON, Black Hat) or bug bounty hall-of-fame credits.
• Certifications such as OSCP, OSEP, OSWE, OSED, OSCE3, CRTO or GXPN.
• Background in ZTNA, VPN, VDI, identity or endpoint security products.
• Windows kernel/driver, macOS or Linux client internals experience.
• Experience with hardware-backed security (secure enclave, TPM attestation) and browser-based security (WebAuthn, WebCrypto).

What success looks like

• Every security-critical design passes your threat model and review before it is built.
• At least one full red team exercise against our own products, with findings fixed at the root cause.
• Key and certificate handling hardened across gateway and clients (HSM/TPM-backed where it matters).
• The team works at code and design depth, not only black-box testing.
• Customers' security teams see Accops product security as a strength.

Why join, and how to apply

• Own product security end to end at a company whose products protect critical enterprise and government access.
• Work directly with the founders, with real authority to block a release on security grounds.
• Build and shape your own team.
• Remote-friendly within India, with competitive pay.