Security Engineer (Product Security)

Security Engineer (Product Security)

Salary: £80,000 - £90,000 + Excellent Benefits
Location: London (Remote-first with occasional travel to the office)
Employment: Full Time, Permanent

This is an opportunity to join a high-growth, PE-backed cybersecurity software company where security isn't simply a support function - it's at the heart of the product itself.

Trusted by Government, Defence, Financial Services and Critical National Infrastructure organisations worldwide, the business develops market-leading technology that protects organisations from advanced file-based cyber threats.

We're looking for a hands-on Security Engineer who enjoys getting into the detail of vulnerabilities, understanding how applications behave and working directly with developers to make software more secure.

This isn't a traditional vulnerability management, SOC or governance position.

Instead, you'll join a small Security Engineering team where you'll investigate security findings, assess real-world exploitability and risk, monitor security tooling and help engineering teams remediate issues effectively.

If you're happiest opening unfamiliar code, understanding why a vulnerability matters and solving security problems alongside developers rather than simply raising tickets, this could be a great fit.

The Role

You'll join a small, high-impact Security Engineering team, working closely with Product and Engineering to embed security throughout the software development lifecycle.

Your initial focus will include vulnerability triage and monitoring security tooling pipelines, investigating findings from automated tools and understanding their practical risk.

You'll also work with AI-assisted security workflows used for code review and triage, with the opportunity to help improve the agents and automation already in place.

This is a hands-on role where you will be trusted to investigate problems independently, work collaboratively with developers and proactively suggest improvements.

Key Responsibilities

• Investigate and triage application and product security vulnerabilities, assessing practical exploitability and business risk.
• Review unfamiliar source code to understand security findings and work with developers on remediation.
• Monitor and troubleshoot security tooling and CI/CD pipelines, investigating failures and root causes.
• Use SAST, DAST, SCA and other automated security tooling to support secure software development.
• Conduct threat modelling and secure design reviews for new features, services and architecture changes.
• Validate fixes and identify root causes to reduce recurring vulnerabilities.
• Use AI agents and AI-assisted tooling to support code review, vulnerability triage and security analysis.
• Contribute to improving security automation, tooling and developer workflows.
• Support cloud, container, Kubernetes and software supply-chain security where relevant.
• Work independently within a small team, proactively identifying improvements and sharing ideas.

What We're Looking For

You'll probably be a great fit if you've:

• Around 3-5 years of hands-on Product Security, Application Security, DevSecOps or closely related Security Engineering experience.
• A strong practical understanding of application vulnerabilities and how to assess their real-world risk.
• Experience reviewing source code and interpreting findings from security tools.
• Worked directly with software engineers to prioritise and remediate security issues.
• Hands-on experience with SAST, DAST, SCA or similar security tooling within CI/CD environments.
• Practical knowledge of threat modelling and secure software development.
• Enough coding or scripting knowledge to understand unfamiliar code and contribute to automation.
• The confidence to work independently, take ownership and remain open to learning and feedback.
• Highly Desirable
• Penetration testing or offensive security experience, particularly if you want to move into defensive Product Security.
• Experience using AI or agentic AI within security engineering, code review or vulnerability triage.
• Experience securing LLMs, AI agents, MCP or other AI-enabled systems.
• Cloud, container or Kubernetes security experience, plus exposure to C#, .NET, Python, Bash or PowerShell.

This Role Probably Isn't For You If...

• Your experience is primarily GRC, audit, compliance or policy.
• Your background is traditional vulnerability management focused mainly on running scanners, raising tickets and chasing remediation.
• Your experience is predominantly SOC, detection or infrastructure security without meaningful application security exposure.
• You're looking for a management-heavy role rather than remaining technically hands-on.
• You prefer purely offensive security and don't want to move towards defensive Product Security.

To Be Considered

Please either apply by clicking online or emailing .

Key Skills: Security Engineer, Product Security Engineer, Application Security Engineer, DevSecOps Engineer, Product Security, Application Security, Vulnerability Analysis, Secure SDLC, Threat Modelling, SAST, DAST, SCA, CI/CD Security, AI Security, Security Automation, Penetration Testing, Cloud Security, Cyber Security.