Product Security & Offensive Engineering Lead

WPP; United Kingdom; Hybrid; GBP 70,000 - 90,000; Full time

Benefits offered by this job

Equal opportunity employer

Culture of respect and belonging

Career progression opportunities

Job summary

WPP is looking for a Product, Application and Offensive Security Lead in the United Kingdom. The role involves embedding security in the design and operation of DTS products and engaging closely with engineering teams. Responsibilities include running threat modeling sessions, performing offensive security tests, and providing practical security guidance.

This position requires strong experience in application security, a good understanding of APIs and cloud applications, and a pragmatic approach to security.

Qualifications

• Strong hands-on experience in application security, product security, or penetration testing.
• Good understanding of modern software engineering, APIs, SaaS platforms, and cloud-native applications.
• Experience with threat modeling and secure design reviews.

Responsibilities

• Provide hands-on security support across DTS products and engineering teams.
• Embed security into the software development lifecycle.
• Run threat modeling and security design reviews.
• Perform offensive security testing of products and APIs.
• Help teams prioritize and remediate security vulnerabilities.

Skills

Application security

Penetration testing

Threat modeling

Security engineering

API security

Cloud-native applications

Education

Degree in Computer Science or related field

Tools

SAST

DAST

CI/CD tools

Job description

WPP is looking for a Product, Application and Offensive Security Lead in the United Kingdom. The role involves embedding security in the design and operation of DTS products and engaging closely with engineering teams. Responsibilities include running threat modeling sessions, performing offensive security tests, and providing practical security guidance.

This position requires strong experience in application security, a good understanding of APIs and cloud applications, and a pragmatic approach to security.