Senior Product Security Engineer

The role

You will take ownership of product security across the development lifecycle. You will work with teams like SRE and Platform Engineering to embed security tools and best practices into products.

What you will do

• Define and own the product security roadmap
• Establish and own the application security vulnerability management process
• Carry out threat modelling for web, mobile and API services
• Assess application and API security through code reviews and SAST/DAST
• Manage third-party penetration tests
• Strengthen security of iOS and Android apps and APIs
• Implement, maintain and automate security tools
• Build secure coding and deployment knowledge through training and mentoring
• Ensure product security practices align with frameworks like OWASP, NIST, ISO 27001, GDPR and PCI DSS

Required qualifications

• Significant experience identifying, assessing and mitigating security risks across application design, code and deployed products
• Experience setting up and running application security vulnerability management processes and reporting
• Experience shaping and delivering a product or application security roadmap
• Experience securing mobile applications and APIs
• Experience testing iOS and Android apps
• Experience applying secure approaches to authentication and authorisation, such as OAuth 2.0 and OpenID Connect
• Hands-on experience with security testing tools such as SAST, DAST and vulnerability scanning solutions
• Practical experience with threat modelling and security reviews
• Experience scoping and managing third-party penetration tests
• Strong grasp of secure coding practices
• Experience embedding security into software development workflows and CI/CD pipelines
• Familiarity with industry standards and frameworks such as OWASP, PCI DSS, ISO 27001 and GDPR

Nice to have

• Mobile app security testing and API security testing tools
• Experience across cloud-native, containerised and infrastructure as code (IaC) environments
• Mobile Application Security Verification Standard and API Security Top 10
• Experience setting up or growing a security champions programme
• Running risk assessments
• Working knowledge of regulatory compliance standards

Benefits

• Private healthcare & dental insurance
• Generous work from abroad policy
• 2-for-1 share purchase plans
• EV Scheme
• Extra festive time off
• Family-friendly benefits
• Clear career paths
• Transparent pay bands
• Personal learning budgets
• Regular learning days

About the company

Trainline is Europe’s leading independent rail platform. It helps millions of travellers find and book rail and coach journeys through its app, website and partner channels.