Principal Application Security Engineer

Come join our passionate team! Barracuda is a leading cybersecurity company providing complete protection against complex threats. Our platform protects email, data, applications, and networks with innovative solutions, and a managed XDR service, to strengthen cyber resilience. Hundreds of thousands of IT professionals and managed service providers worldwide trust us to protect and support them with solutions that are easy to buy, deploy, and use.

We know a diverse workforce adds to our collective value and strength as an organization. Barracuda Networks is proud to be an Equal Opportunity Employer, committed to equal employment opportunity and equitable compensation regardless of race, gender, religion, sex, sexual orientation, national origin, or disability.

Role Overview:

As a Principal Application Security Engineer, you will be tasked with shaping, growing, and leading Barracuda’s Application Security program. Additionally, as the most senior member of the AppSec team, you will have the opportunity to provide mentorship to other team members and have a say in the direction of the overarching security program and initiatives.

Candidates should have deep expertise in modern Application Security and Product Security practices, have experience defining and growing appsec/prodsec programs, be familiar with product development workflows/lifecycles, and have experience owning, planning, and executing initiatives across a complex multi-stakeholder business setting.

Core requirements:

- 8-10+ years in product-focused AppSec: Able to move orgs from reactive pen-test/documentation-heavy to proactive guardrail-driven programs. Has a track record of embedding security across the development life cycle and reducing late-stage findings via automation and developer enablement.

- Strong understanding of modern AppSec and ProdSec concepts: Deep practical (hands-on) knowledge of core security concepts across AppSec, ProdSec, and Cloud.

- Experience building/growing AppSec and ProdSec programs: Hands-on experience building or growing modern AppSec/ProdSec programs in a product environment.

- Hands-on experience owning long-term initiatives: Experience and a proven track record of owning workstreams, initiatives, or impactful project scope over an extended (year+) period.

- Proficient in Threat Modeling: Can facilitate lightweight, feature-level threat models, drive risk-based discussions, and flag high-risk changes across a broad spectrum of tech stacks and product designs.