Best Companies for Product Security Jobs in 2026

How we ranked employers

Most "best companies" lists are opinion. This one is built from data. On 28 September 2026 we analysed every live role on ProductSecurityJobs.com, collected directly from employer career sites: 1,303 security roles across the companies we track.

We ranked employers primarily by the number of live roles with Product Security, Application Security, AppSec, DevSecOps or Software Security in the title, because those are the clearest signal that a company has a dedicated product security function that is actively hiring. We then looked at total live security roles, how many roles are at staff, principal or leadership level, and the median base salary where employers published US pay ranges.

A ranking like this is a snapshot. Hiring moves quickly, and a company with one open role today may have ten next month. It also only covers employers we track, which is why a few well-known names are missing; see the note at the end. Use it as a starting point, then read the roles themselves.

The top 15 employers for product security roles

Dedicated roles are those with a product or application security title. Median pay is the midpoint of published US base salary ranges, shown where an employer published at least three. Select a company to see its current roles.

Best for pay

If compensation is your priority, AI labs and large software companies lead. Anthropic published the highest security salaries we saw, with a median base midpoint of $363,000 across 19 published ranges and several staff-plus security roles advertised at $405,000 to $485,000. ServiceNow's published product security ranges had a median midpoint of $283,000, with most of its open roles at principal or staff level.

Among companies that published at least three ranges, Cadence Design Systems ($235,000), Datadog ($216,000), Cloudflare ($215,000), Salesforce, Adobe and GitLab (each around $203,000) and Palo Alto Networks ($202,000) also stood out. These are base salaries; equity at software companies often adds substantially more. Our product security salary guide breaks pay down by level and location.

Best for senior and leadership roles

Experienced engineers looking for staff, principal or lead roles should look first at the companies with the deepest senior benches. JPMorgan Chase had 43 live security roles at lead level or above, the most of any employer we track, reflecting its very large engineering organisation. ServiceNow and Palo Alto Networks each had 19 senior roles open, Databricks had 12, and Morgan Stanley, Wells Fargo, Wabtec and GE Vernova each had eight or more.

Senior product security roles at large companies often carry a broad remit: a whole product line, a platform, or a security architecture function. They are also where the biggest pay jumps happen, because staff and principal bands sit well above senior.

Software, cloud and AI companies

Software companies are the traditional home of product security, because the product is what customers buy and trust. Beyond the top 15, Adobe, Okta, Salesforce, GitLab and Datadog all had dedicated product or application security roles open, with Okta hiring for staff-level product security engineers in both PSIRT and security review teams.

AI companies are the fastest-growing segment. Alongside Anthropic, AI-heavy engineering organisations increasingly hire for the security of machine-learning features, agents and model infrastructure, a specialism that barely existed a few years ago. Payments and fintech companies such as Stripe and Robinhood often advertise under Security Engineer or Offensive Security titles rather than Product Security, so read the role description closely.

Security vendors

Security vendors need product security more than most, because a vulnerability in a security product is especially damaging to customer trust. Palo Alto Networks, Fortinet, CrowdStrike and Okta all ranked for dedicated product security hiring. Working at a vendor can be a fast way to learn, because you are surrounded by security specialists and the product itself is a security tool.

Hardware, devices and industrial companies

One of the clearest trends in the data is how much product security hiring now happens outside software companies. Boeing ranked third, with 12 of its 13 live security roles dedicated to product security. Medtronic, NXP Semiconductors, Johnson Controls, Airbus, Rockwell Automation and GE Vernova all had product security roles open too.

These roles secure physical products: medical devices, aircraft systems, chips, building controls and industrial equipment. They often involve embedded systems, firmware and hardware security, and regulation plays a large part, from medical device cybersecurity requirements to the EU Cyber Resilience Act. For engineers with embedded or hardware experience, this is one of the least crowded routes into product security.

Banks and financial services

Large banks run some of the biggest engineering organisations in the world and hire security engineers at scale. JPMorgan Chase had 59 live security roles, Goldman Sachs had 21 including secure SDLC positions, and State Street, London Stock Exchange Group, Wells Fargo, Morgan Stanley and Citigroup all had application security roles open. Banks tend to use Application Security rather than Product Security titles, and published pay is typically below that of software companies, but they offer stability, scale and strong training.

Consulting firms

Booz Allen Hamilton and Accenture both ranked in the top five by volume. Booz Allen published pay for all 64 of its live security roles, with a median midpoint of $142,000, lower than product companies but with many government-focused roles that may require clearance. Consulting is a common and effective way to gain broad exposure early in a security career, and many product security engineers started there.

What makes a company good for product security

Volume and pay matter, but they are not everything. The employers where product security engineers do their best work tend to share a few traits, and it is worth asking about each one in interviews.

• A dedicated product security team with a clear remit, not a single person covering everything
• Security involved in design decisions early, not only at release
• Engineering teams that own and fix their own vulnerabilities, with security as a partner
• A public vulnerability disclosure or bug bounty programme
• Investment in paved roads and secure-by-default platforms rather than only scanning
• A credible career ladder for security engineers up to staff and principal level
• Leadership that treats security incidents as learning opportunities, not blame exercises

Companies we do not yet track

Several of the largest employers of product security engineers, including Google, Meta, Microsoft, Amazon and Apple, run their own careers systems that we do not yet collect from, so they do not appear in this ranking. They remain some of the biggest product security employers in the world, and we plan to add them. In the meantime we have recently added more security-focused employers, including Wiz, Chainguard, Snowflake, Vercel and 1Password.

Browse all current product security jobs, or read what product security is and how to get into product security.

Frequently asked questions

Which companies hire the most product security engineers?

In our September 2026 data, ServiceNow had the most live roles with a product or application security title, followed by Booz Allen Hamilton, Boeing, Palo Alto Networks and Accenture. JPMorgan Chase had the most senior security roles open.

Which companies pay product security engineers the most?

AI labs and large software companies pay the most. Anthropic published the highest security salaries we saw, with a median base midpoint of $363,000. ServiceNow, Cadence, Datadog, Cloudflare, Salesforce, Adobe, GitLab and Palo Alto Networks also published medians above $200,000.

Do banks hire product security engineers?

Yes, though they usually use the title Application Security Engineer. JPMorgan Chase, Goldman Sachs, State Street, Wells Fargo, Morgan Stanley and Citigroup all had application security roles open in September 2026.

Are there product security jobs outside software companies?

Yes, and it is a growing area. Boeing, Medtronic, NXP Semiconductors, Airbus, Johnson Controls and Rockwell Automation all hire product security engineers to secure physical products such as aircraft, medical devices, chips and industrial equipment.