Product Security Engineer

London, England, United Kingdom

Apply with AI Apply

Not SpecifiedCompensation

Mid-level (3 to 4 years), Senior (5 to 8 years)Experience Level

Full TimeJob Type

UnknownVisa

Biotechnology, SoftwareIndustries

Requirements

Candidates should have 4 years of experience in security engineering, DevSecOps, application security, or related software engineering roles. A strong foundational knowledge of secure coding and OWASP Top 10 risks is required, along with experience in at least one modern programming language such as Python, Java, JavaScript, Go, or C#. Familiarity with cloud platforms like AWS, Azure, or GCP and container technologies such as Docker or Kubernetes is necessary. Exposure to security tooling like SAST, SCA, or DAST scanners (e.g., Semgrep, Endor, Burp) and a basic understanding of identity and access controls (OAuth, SAML, API tokens) are also required. Strong collaboration and communication skills with a willingness to learn and grow are essential.

Responsibilities

The Product Security Engineer will assist in integrating security practices into the software development lifecycle, including design reviews and backlog grooming. They will participate in structured threat modeling exercises and work with engineering teams to review findings from SAST, SCA, DAST, and container scans, tracking remediation progress. Responsibilities also include conducting basic secure code and configuration reviews, escalating high-risk findings, and helping to maintain and enhance security scanning integrations in CI/CD pipelines. Additionally, the role involves assisting in preparing for and triaging penetration tests, and helping to develop security best practices, developer guidance, and response runbooks.

Skills

Product Security

Secure SDLC

Threat Modelling

Vulnerability Triage

SAST

SCA

DAST

Container Scans

Secure Code Review

Configuration Review

Security Tooling

Automation

DevOps

Cloud-First

Smarsh

Archiving and compliance solutions provider

About Smarsh

Smarsh provides archiving and compliance solutions specifically designed for financial services, government agencies, and other regulated industries. Their main product is a cloud-based archive that allows organizations to securely store, search, and manage their communications data, including emails, text messages, and social media interactions. This system helps businesses meet complex security, data privacy, and regulatory requirements. Smarsh differentiates itself from competitors by offering a scalable Software-as-a-Service (SaaS) model that caters to both large enterprises and smaller organizations, ensuring that clients can adapt to evolving regulations. Their goal is to help organizations efficiently manage their communication data, identify risks, and maintain compliance, particularly through tools like Connected Capture for Microsoft Teams, which supports remote workforces.

Portland, OregonHeadquarters

2001Year Founded

$42.4MTotal Funding

BUYOUTCompany Stage

Enterprise Software, Cybersecurity, Financial ServicesIndustries

1,001-5,000Employees