Product Security Engineer

SRT Marine Systems plc; Warmley; Hybrid; GBP 60,000 - 90,000; Full time

Benefits offered by this job

25 days annual leave

Development opportunities

Competitive salary

Job summary

SRT Marine Systems plc, a market leader in maritime surveillance technology, seeks a Product Security Engineer. The role is based primarily from our Bristol office with occasional travel to Cardiff and Bath, offering hybrid working arrangement.

You will embed secure development practices, perform threat modelling and risk assessments, and work closely with developers to ensure security is built into our products from design to delivery.

Qualifications

• Strong software engineering background with ability to read code and review designs.
• Experience in application security or secure software engineering in a software-led environment.
• Experience across the software development lifecycle: threat modelling, secure coding, testing, vulnerability management.
• Ability to communicate security concerns to developers clearly.

Responsibilities

• Champion security within product development teams.
• Embed secure development practices across the SDLC, including secure coding standards and code review.
• Carry out threat modelling, secure design reviews and technical risk assessments.
• Assign pragmatic risk levels and prioritise remediation alongside feature delivery.
• Support vulnerability remediation and root cause analysis.
• Track the security of third-party components and respond to new vulnerabilities.
• Ensure security features are represented in product roadmaps and backlog decisions.
• Coordinate with external security partners for penetration testing and assessments.
• Contribute to security standards, metrics and ways of working to improve maturity.
• Support wider assurance and certification activity (ISO 27001).

Skills

Software engineering

Application security

Threat modelling

Secure coding

Vulnerability management

Communication skills

Job description

SRT Marine Systems plc (SRT) are a market leader in its domain of international marine surveillance technology and systems. We are respected, established and an ambitious multi-national company headquartered in the UK with a global customer base. The company has a global impact in the marine domain by leading the next generation of Maritime Domain Awareness 'MDA' technologies, products and systems that significantly enhance, security, safety and environment protection and sustainability. Our customers are worldwide and range from the largest national coast guards to individual vessel owners. SRT is an exciting company where high-quality results are rewarded. We are ambitious and are constantly seeking to innovate to deliver better products and services to our customers. We strive to make SRT a rewarding and challenging place to work where talented hard-working individuals have the opportunity to make a real impact across the marine world.

We are looking for a Product Security Engineer to help ensure security is properly built into our products from the ground up - in the designs we choose, the code we write, and the way our software is developed, tested and delivered.

This is a hands-on role embedded within our product development teams. You as a Product Security Engineer will work day-to-day with software developers, testers and product owners to improve the security of what we build and how we build it, and to make sure security has a clear voice when product priorities are set.

The role is a dedicated security role focused on the security of how we develop our products. It combines technical depth - reviewing designs and code, threat modelling, assessing risk pragmatically - with the credibility and communication skills to bring experienced developers along. It offers a genuine opportunity to grow into the leadership of our product security capability, and we welcome ambitious candidates ready to step up into a security specialism from a strong software engineering background.

The role of Product Security Engineer is primarily based from our Bristol office, but you must be willing to travel to our offices in Cardiff and Bath on occasion, with good flexibility for Hybrid working.

Responsibilities - Product Security Engineer - not exhaustive:

• Champion security within our product development teams, providing a clear day-to-day voice for security in design, code and backlog decisions.
• Embed secure development practices across the software development lifecycle, including secure coding standards, code review, testing, CI/CD and related controls.
• Carry out threat modelling, secure design reviews and technical risk assessments for new and existing product capabilities, so that security is designed in from the start.
• Assign pragmatic risk levels and support sensible prioritisation of remediation alongside feature delivery and other technical work.
• Support vulnerability remediation, including root cause analysis and long-term fixes.
• Track the security of third-party components and dependencies within our products, and lead our response when new vulnerabilities and supply-chain incidents emerge.
• Ensure security features and fixes are properly represented in product roadmap, backlog and design decisions, working with product owners and engineering leadership.
• Work with our external security partners to arrange and act on penetration testing and security assessments of our products.
• Contribute to security standards, metrics and ways of working that improve product security maturity over time.
• Support wider assurance and certification activity, including ISO 27001 or other relevant standards, with evidence of how our softwareis securely built.

Requirements - Product Security Engineer - not exhaustive:

• A strong software engineering background, with the technical depth to read code, review designs and engage credibly with experienced developers.
• Experience of, or a strong demonstrable specialism in, application security or secure software engineering in a software-led environment.
• Practical experience applying security across the software development lifecycle, including areas such as threat modelling, secure coding, testing, vulnerability management and secure delivery.
• Good understanding of how product and development teams operate, including how security considerations are balanced alongside product delivery.
• The judgement to assess exploitability and business impact pragmatically.
• Strong communication skills, with the ability to turn technical security concerns into clear, actionable decisions that developers respect.
• The ambition to make security your dedicated focus and to grow with the role as we build our product security capability.
• Familiarity with recognised standards, frameworks or certifications such as OWASP, CSSLP, ISO 27001 or similar would be helpful.
• Experience in a product, platform or SaaS business.
• Experience in high-trust, regulated or mission-critical environments would be valuable.

Benefits

• Highly Competitive Salary and benefits package
• 25 days annual leave rising to 28 days with service
• Real individual development opportunities

SRT Marine Systems plc is an equal opportunity employer. We are committed to creating an inclusive environment for all employees and welcome applications from all backgrounds.