Staff Product Security Engineer
On-siteCambridge, England, United Kingdom
Job Summary
Design and maintain security regression test suites covering critical application flows, integrating them into CI/CD pipelines to prevent vulnerabilities from recurring. Lead structured threat modeling sessions for existing components and new features, translating identified attack surfaces into test cases and mitigation plans. Perform manual and automated offensive security activities simulating real attacker behavior to uncover logic flaws and business impact vulnerabilities beyond standard tooling. Continuously assess the platform against OWASP Top 10 categories, partnering with engineering teams to reproduce issues, prioritize fixes, and validate remediation. Act as a security gatekeeper while enabling teams through secure-by-design guidance and automation.
Required Qualifications
- 5+ years in Application / Product Security
- Bachelor's Degree or equivalent of 12 years of work experience
- Strong hands-on experience in: Web application security testing
- Strong hands-on experience in: API security
- Strong hands-on experience in: Threat modeling methodologies
- Strong hands-on experience in: Deep understanding of OWASP Top 10
- Experience with: Manual penetration testing
- Experience with: Security regression testing
- Experience with: CI/CD security integration
- Ability to identify business logic vulnerabilities
- Strong understanding of: Authentication, authorization, and session management
- Strong understanding of: Multi-tenant architectures
- Strong understanding of: Cloud-native systems
Desired Qualifications
- Experience in SaaS / multi-tenant platforms
- Familiarity with: Bug bounty programs
- Familiarity with: Red teaming
- Familiarity with: Security automation frameworks
- Knowledge of: AWS
- Knowledge of: Identity systems and federation (SSO, MFA)
- Background in software engineering (ability to read/write code)
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.