Product security engineer in HR technology

Personio; Greater London; Hybrid; GBP 90.000 - 130.000; Vollzeit

Benefits dieser Stelle

Pre-IPO equity

Salary & benefits

Additional leave after 2 years

Impact Day

Family leave & mental health support

Catered lunch and snacks

Zusammenfassung

Personio's HR platform is seeking a Product Security Engineer to own the end-to-end vulnerability lifecycle from discovery to remediation and reporting. You will maintain and evolve the security toolchain, ensuring reliable, integrated workflows across development teams.

You will respond to security incidents, reproduce vulnerabilities, and coordinate tests with vendors and researchers while guiding engineers in secure design and code reviews.

Qualifikationen

• 5+ years of hands-on experience in product security, offensive security, systems security or equivalent professional education.
• Experience with vulnerability management programmes and prioritising findings based on real-world risk (e.g., exploitability, exposure, CVSS/EPSS/KEV).
• Strong understanding of secure-by-default design, least privilege, robust authentication and authorization patterns, secure secrets handling, and secure logging.
• Strong understanding of threat modeling and ability to assess exploitability and attack paths by reviewing code and docs.
• Ability to guide engineers across languages and frameworks while balancing security and development.
• Fluent English communication skills (written and verbal).

Aufgaben

• Own the end-to-end vulnerability lifecycle from discovery through triage, remediation tracking, risk acceptance, and reporting.
• Maintain and evolve the product security toolchain for reliable, integrated security workflows.
• Respond to security incidents and reproduce vulnerabilities; conduct internal testing as needed.
• Coordinate penetration tests with vendors and Bug Bounty researchers to focus research areas.
• Act as trusted security advisor to engineering through design and code reviews and ad-hoc guidance.
• Maintain security policies, guidance, documentation, and metrics for stakeholders and leaders.
• Drive security awareness across the engineering organization with knowledge-sharing sessions.

Kenntnisse

Vulnerability management

Threat modeling

Incident response

Security policies

Security awareness

Vendor coordination

Jobbeschreibung

Product security engineer in HR technology

Personio's intelligent HR platform helps small and medium-sized organizations unlock the power of people by making complicated, time-consuming tasks simple and efficient. Our team of 1,500 Personios is building user-friendly products that delight our 15,000+ customers and their 1.5 million employees. Ready to make an impact from day one?

• You own the end-to-end vulnerability lifecycle from discovering vulnerabilities, through its triage to tracking remediation, managing risk acceptances, and reporting on security posture across the organisation.
• You maintain and evolve the product security toolchain (traditional and AI workflows), ensuring teams have reliable, well-integrated tools to identify and address security issues within their development environment.
• You respond to security incidents, provide security expertise for internal customers and use your technical prowess to find and reproduce vulnerabilities or sometimes perform small internal pentests.
• You manage collaboration with security vendors and external researchers (Bug Bounty) and coordinate penetration tests, to ensure focus on the right research areas and help set correct scopes for their exercises.
• You act as a trusted security advisor to engineering teams, providing design reviews, code reviews, and ad-hoc guidance to proactively embed security into product development before issues reach production.
• You maintain security policies and best-practice guidance ensuring development teams have clear security standards to follow. As well as documentation and metrics for your stakeholders and business leaders.
• You drive security awareness across the engineering organisation through the knowledge sharing sessions, and ongoing enablement initiatives that scale security knowledge across engineering.
• 5 + years of hands-on experience in product security, offensive security, systems security or equivalent professional education.
• You have a practical experience with vulnerability management programmes or equivalent experience consolidating security issues from different sources and prioritising findings based on real-world risk (e.g., exploitability, exposure, business impact, CVSS/EPSS/KEV).
• You are comfortable defining and reporting vulnerability management programme metrics showing programme health and driving accountability.
• You possess technical expertise of best practices in security engineering, like secure-by-default design, least privilege, robust authentication and authorization patterns, secure secrets handling, safe dependency management, and high-quality security logging and monitoring.
• You have a strong understanding of security vulnerabilities and threat modeling. You are able to assess real-world exploitability and attack paths by reviewing code and technical documentation for security flaws.
• You can guide engineers on remediation methods and strategies across different programming languages and frameworks, earning trust and understanding the balance between security and development experience.
• You have fluent English communication skills (written and verbal) and can effectively translate complex security concepts for executive, technical, and non-technical audiences.
• You take initiative to identify gaps, improve processes, and drive security outcomes rather than waiting for issues to surface, embodying a bias for action approach.
• You can handle ambiguous situations, accurately deciding on relevant information. You can deal with competing priorities, focusing your efforts for maximum security impact.
• At Personio, we value in-person collaboration while also offering flexibility. This role requires 2 days per month in the office.
• Receive a competitive reward package – reevaluated each year – that includes salary, benefits, and pre-IPO equity
• Enjoy 28 days of paid vacation, plus an additional day after 2 and 4 years
• Make an impact on the environment and society with 1 (fully paid) Impact Day
• Receive generous family leave, child support, mental health support (including 24 sessions per year with Oli for yourself and 10 sessions for a significant other), and sabbatical opportunities
• We enjoy gathering for meals, cultural initiatives, and events like local Summer Sessions and year-end celebrations. There's also healthy snacks, drinks, and a weekly catered lunch.