Product Security Engineer: Build Secure, Resilient SaaS

MirrorWeb; Manchester; On-site; GBP 90,000 - 120,000; Full time

Job summary

MirrorWeb is seeking a Product Security Engineer to defend a regulated, highly valuable SaaS platform. You will embed with engineering teams, harden surfaces, and build detections against real attacks, while extending secure-by-default practices across the product and supply chain.

You will work on threat modeling, agent-driven security, and IR automation, ensuring secure development and integration across multi-tenant architecture.

Qualifications

• Must have several years writing production software on AWS.
• Security is your field of expertise, with a track record of defending systems and deploying detections against real attacks.
• You follow supply-chain incidents and reason about real threat actors, not generic categories.
• Hands-on experience using AI coding agents (Claude Code, Cursor, Codex) in production workflows.
• You can model agent harnesses, trust boundaries, and where they break.

Responsibilities

• Engineer defence into the product, including multi-tenant isolation, encryption, IAM as code, and secure-by-default patterns.
• Defend the supply chain with provenance, integrity checks (SLSA, sigstore), and runtime telemetry for third-party risk.
• Detect, respond, and contain through automated IR workflows, containment, rotation, and forensics tooling.
• Secure the agentic development surface by guarding prompts, credentials, provenance, and sandboxing for agent-enabled changes.
• Lead the security craft inside engineering by embedding with platform/product teams and driving security tooling and patterns.

Skills

AWS production software

Security engineering

Threat modeling

Adversarial mindset

AI agent tooling

System hardening

Security automation

Tools

Claude Code

Cursor

Codex

Job description

MirrorWeb is seeking a Product Security Engineer to defend a regulated, highly valuable SaaS platform. You will embed with engineering teams, harden surfaces, and build detections against real attacks, while extending secure-by-default practices across the product and supply chain.

You will work on threat modeling, agent-driven security, and IR automation, ensuring secure development and integration across multi-tenant architecture.