About the Role:

We are looking for an experienced Lead Product Security Engineer to drive Application Security, Product Security, and Cloud Security initiatives across the Secure SDLC. The role involves defining security strategies, conducting architecture and threat assessments, strengthening cloud-native security, and implementing DevSecOps practices. The ideal candidate should combine strong hands-on technical expertise with the ability to lead security initiatives, guide engineering teams, and ensure security is embedded across the product development and deployment lifecycle.

Responsibilities:

- Lead Application Security and Product Security initiatives across the complete Secure Software Development Lifecycle (SSDLC).

- Define security strategies, standards, and technical direction for applications, products, and cloud-native platforms.

- Conduct threat modelling and risk assessments across application, API, cloud, and product architectures.

- Define and implement security controls across design, development, CI/CD pipelines, deployment, and production environments.

- Lead SAST, DAST, SCA, and vulnerability management initiatives, driving identification, prioritisation, and remediation of security issues.

- Review application, product, and solution architectures to identify security risks and recommend appropriate controls.

- Conduct security assessments of AWS/Azure environments, covering IAM/RBAC, network security, encryption, secrets management, and monitoring.

- Drive container and Kubernetes security, including image scanning, access controls, secrets management, network policies, and runtime security.

- Establish and strengthen DevSecOps practices by integrating automated security checks into CI/CD pipelines.

- Define security guidelines and best practices aligned with OWASP and relevant industry security frameworks.

- Collaborate with Software Engineering, DevOps, Cloud, Architecture, and Product teams to address security risks and implement solutions.

- Prioritise vulnerabilities based on technical and business impact and ensure timely remediation.

- Mentor security engineers and provide technical guidance to development and engineering teams.

- Lead security reviews, audits, risk reporting, and continuous security improvement initiatives.

Requirements:

- 8 - 11 years of experience in Application Security, Product Security, Cloud Security, DevSecOps, or Cybersecurity, with demonstrated technical leadership.

- Strong hands-on expertise in Application Security, Product Security, and Secure SDLC practices.

- Proven experience in threat modelling, security assessments, and risk analysis.

- Strong knowledge of AWS and/or Azure security architecture and controls.

- Hands-on experience with Docker, Kubernetes, and container security.

- Strong understanding of SAST, DAST, SCA, OWASP Top 10, and vulnerability management.

- Experience designing and implementing DevSecOps practices and CI/CD security controls.

- Good understanding of IAM/RBAC, API security, encryption, secrets management, and cloud security.

- Experience with security tools such as Snyk, Checkmarx, Fortify, Veracode, SonarQube, Trivy, Burp Suite, Prisma Cloud, Aqua, or equivalent.

- Ability to review security architectures and translate identified risks into practical technical solutions.

- Experience leading technical discussions, mentoring engineers, and influencing development and architecture teams.

- Excellent communication, stakeholder management, and problem-solving skills.

- Must have strong hands-on implementation experience alongside security leadership capabilities.