Senior Product Security Engineer

Responsibilities

• ● Reporting to: Head of Information Security
• ● What you will do:
• ● Design and introduce security gates into the development lifecycle, including embeded secure release practices and guardrails into the way software is built and deployed.
• ● Lead threat modelling for new products and major changes
• ● Provide secure-by-design input for new product builds across card issuing, embedded finance / banking-as-a-service, and other payment products
• ● Define secure-by-default architecture patterns for the application layer - authentication, authorization, API design, service-to-service trust - so the secure path is the easiest path for engineering teams
• ● Decide where traditional tooling is the right fit and where AI-assisted alternatives provide better coverage or efficiency
• ● Own CI/CD pipeline and software supply-chain security controls across engineering teams
• ● Implement and improve container image scanning, dependency management, software bill of materials, and security checks on infrastructure-as-code and deployment manifests
• ● Build the practice AI-first - introduce AI agents and LLM-assisted workflows the default delivery mechanism for application security
• ● Drive remediation of application-layer findings with engineering teams, including findings from penetration tests, scanners, and disclosure reports
• ● What we need:
• ● + years of experience in Product Security, Application Security in payments, fintech, banking, e-money, or another fintech product environment
• ● Strong hands-on experience embedding security into the software development lifecycle
• ● You read code comfortably and hold your own in design discussions with senior engineers
• ● Proven experience with threat modelling, secure-by-design reviews, and working with engineers during architecture and delivery stages
• ● Hands-on experience with application security tooling such as SAST, SCA, secrets detection, and DAST
• ● Hands-on experience securing cloud-native applications on AWS or other major cloud