below marketmost similar roles pay hereabove market
This role pays less than
69%
of similar roles. Most pay
$158,550–$219,343
— the blue band above.
At the midpoint, this role pays about
$162k
versus about
$189k
for comparable roles.
Based on 240 similar postings.
Employer
About PayPal
PayPal is a leading global digital wallet and online payment system, founded in 1998, that allows individuals and businesses to send, receive, and manage funds securely in over 200 markets.
PayPal currently has
95 open roles
on FindRole.
Listed pay typically runs
$160,500–$238,700
across 89 roles with salary data.
As a Senior Product Security Engineer, you will join the security team to design, build, and operate automated security scanners and developer guardrails across the software development lifecycle. You will identify and reduce risks involving source code, open source dependencies, secrets, software supply chains, and AI/LLM tools. Your daily work involves turning security requirements into reliable automation that catches risks before software reaches production. You will utilize technologies including Python, Go, Bash, Java, and Javascript, while working with GCP, Kubernetes, and Terraform. Key responsibilities include tuning SAST, SCA, and policy-as-code systems, managing SBOMs, and investigating gaps in artifact signing. You will collaborate with engineering and platform teams to improve detection quality and remediation ease for complex threats within the global payment ecosystem.
Design, build, and operate automated security scanners and developer guardrails across the software development lifecycle.
Identify and reduce risks across source code, open source dependencies, secrets, and software supply chains.
Develop and integrate security automation for CI/CD pipelines, including SAST, SCA, and secrets detection.
Write and review code, APIs, and detection rules to enforce security policies and process findings.
Tune security controls to investigate gaps, reduce false positives, and improve remediation guidance.
Evaluate new technical surfaces, such as AI/LLM tools, to define and implement appropriate security controls.
Use telemetry and metrics to improve the reliability, coverage, and performance of security tooling at scale.
Partner with engineering and platform teams to troubleshoot integrations and deliver practical security improvements.
What we're looking for
3+ years of relevant experience and a Bachelor’s degree or an equivalent combination of education and experience.
3-5 years of relevant experience in software engineering, application or product security, DevSecOps, or cybersecurity.
Experience developing, integrating, or operating security automation in CI/CD or developer workflows, including SAST, SCA, secrets detection, or software supply chain security.
Programming or scripting experience in multiple languages such as Python, Go, and Bash with the ability to write, review, and troubleshoot code.
Working knowledge of secure software development, common application vulnerabilities, dependency and package ecosystem risks, and practical remediation approaches.
Experience with GCP, complemented by hands-on expertise with Kubernetes, Terraform, and other cloud-native technologies.
Experience with SLSA, software bills of materials (SBOMs), provenance, artifact signing or verification, package repositories, or dependency governance (preferred).
Experience creating or tuning rules for static analysis, secrets detection, or policy-as-code systems (preferred).