Staff Product Security Engineer
On-siteLisbon, Lisbon, Portugal
Job Summary
Design and maintain security regression test suites integrated into CI/CD pipelines to prevent vulnerability recurrence. Lead structured threat modeling sessions for existing components and new features to identify attack surfaces and translate findings into test cases and mitigation plans. Conduct manual and automated offensive security activities simulating real attacker behavior to uncover high-impact logic flaws and abuse paths beyond standard tooling. Continuously assess the platform against OWASP Top 10 categories and partner with engineering teams to reproduce issues, prioritize fixes, and validate remediation. Act as a security gatekeeper by reviewing new features for risks while enabling teams through guidance and automation. Ensure all changes are threat-modeled and covered by regression tests without creating process bottlenecks.
Required Qualifications
- 5+ years in Application / Product Security
- Bachelor's Degree or equivalent of 12 years of work experience
- Strong hands-on experience in: Web application security testing
- Strong hands-on experience in: API security
- Strong hands-on experience in: Threat modeling methodologies
- Strong hands-on experience in: Deep understanding of OWASP Top 10
- Experience with: Manual penetration testing
- Experience with: Security regression testing
- Experience with: CI/CD security integration
- Ability to identify business logic vulnerabilities
- Strong understanding of: Authentication, authorization, and session management
- Strong understanding of: Multi-tenant architectures
- Strong understanding of: Cloud-native systems
Desired Qualifications
- Experience in SaaS / multi-tenant platforms
- Familiarity with: Bug bounty programs
- Familiarity with: Red teaming
- Familiarity with: Security automation frameworks
- Knowledge of: AWS
- Knowledge of: Identity systems and federation (SSO, MFA)
- Background in software engineering (ability to read/write code)
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.