Product Security Engineer

Deep, hands-on skill in one or two security domains — application security, cloud security, identity and access management, cryptography, detection and response, or platform security — backed by real evidence of impact

An instinct for trust boundaries, failure modes, blast radius, and attacker behaviour, rather than viewing vulnerabilities in isolation

A knack for turning complex security risk into terms that land with engineers, product managers, and senior leadership alike, and for shaping outcomes through persuasion rather than title

A risk-based approach — weighing decisions proportionately under uncertainty, and always asking whether the work cuts real risk rather than just checking a compliance box

Comfort juggling multiple teams and technical domains at once without losing quality or judgement

A history of finding gaps and pushing security fixes through to completion, even in messy or loosely defined problem spaces

Time spent in or around regulated, high-assurance, or defence-adjacent settings where security demands are intricate and failure carries real weight

Practical offensive security background — red teaming, penetration testing, or adversarial simulation — that shapes how you think about defensive design and threat modelling

Awareness of security issues unique to AI or machine learning systems, such as model integrity, data pipeline security, or adversarial ML

A hand in building security programmes at scale — security champions networks, secure development lifecycle tooling, or company-wide risk frameworks

A background in cloud-native security engineering, especially across AWS, GCP, or Azure, spanning infrastructure-as-code, container security, and cloud identity patterns

Some exposure to supply chain security issues, such as dependency management, build pipeline integrity, or third-party component assurance

Experience working with classified data, government security frameworks, or cross-domain security requirements