Senior Product Security Engineer

Numan; Greater London; On-site; GBP 90,000 - 120,000; Full time

Job summary

Numan is building a regulated digital health platform with a security‑minded, hands‑on senior engineer role. You will own threat modelling, secure by design, and practical controls across web, API, and AI features, collaborating with Engineering, Product, Clinical, and Legal to scale security through the organization.

You’ll lead automated testing, secure design reviews, and integration of security tooling into CI/CD, Kubernetes environments, and cloud services, with a strong focus on protecting

Qualifications

• Senior level with hands-on application security in a product engineering environment.
• Demonstrated threat modelling practice in real projects.
• Offensive security skills for modern web and API stacks; relevant certification or equivalent experience.
• Ability to read production code and meaningfully review pull requests.
• Knowledge of cloud-native security models; preference for GCP, AWS/Azure acceptable.
• Experience embedding security tooling into CI/CD pipelines.

Responsibilities

• Run threat modelling sessions with product and engineering on new features and architecture.
• Own and advance Secure by Design processes and threat modelling pathways.
• Translate threat models into prioritized, implementable controls for engineering teams.
• Drive upstream design decisions to prevent costly fixes later.
• Assess and secure AI systems in production, including LLMs and agentic workflows.
• Build threat models for agent-specific risks such as prompt injection and data exfiltration.
• Perform automated application and API penetration testing across web, mobile, and cloud services.
• Lead third-party penetration engagements and remediate findings with engineering.
• Embed security into pipelines: SAST, SCA, secrets detection, IaC, container hygiene.

Skills

Application security

Threat modelling

Offensive security

Code review

Cloud security (GCP/AWS/Azure)

CI/CD security

AI/security in production

Kubernetes security

Tools

Burp Suite

OWASP ZAP

GCP

Job description

About Numan

Founded in 2018, we've already grown to be a 300+ team distributed across the globe, united by a singular mission: empowering people to take control of their health.

Numan is transforming health: we've built a cutting‑edge platform that integrates diagnostics, medication, supplements, digital programmes, and doctor consultations. Giving people the tools they need to maximise life.

To deliver on our transformative mission, we are guided by our 5 company values:

• Patients first.
• Learn fast.
• Own the quality.
• Succeed together.
• Care deeply.

Backed by top‑tier investors, Numan is already having a positive impact on hundreds of thousands of patients here in the UK, and we want you to help us deliver this mission!

The Role

We build and operate a regulated digital health platform. Patients trust us with clinical data, identity documents and payment details, and our clinicians trust our systems to be correct. That makes application security a patient safety concern, not just a compliance one.

We are shipping quickly, adopting AI and agentic systems across clinical operations and patient‑facing products, and running a lean security function that scales through engineering leverage rather than headcount. We need a senior engineer who can go deep on design and code, then bring the rest of the business along with them.

This is a hands‑on individual contributor role with genuine influence over how the platform is built.

The Team

You will work within the Cyber Security function, collaborating directly with Engineering, Product, Clinical, Legal, and the executive team. Security at Numan is not a gatekeeping function - it scales through influence, credibility, and being useful early.

Responsibilities

• Running threat modelling sessions with product and engineering teams on new features and architectural changes - STRIDE-based, with clinical safety, abuse, and business‑logic threats kept in mind alongside the technical ones.
• Owning and evolving our Secure by Design process: self‑evaluation screening, secure design review, and the threat modelling pathway, including our use of automated tooling against technical artefacts.
• Turning threat models into tracked, prioritised controls that engineering teams actually implement.
• Pushing design decisions upstream so the cheap fix is designed in rather than the expensive one retrofitted.
• Assessing and securing AI systems in production: LLM‑backed features, retrieval pipelines, agentic workflows, tool‑calling integrations, and the MCP and API surfaces that connect them.
• Building practical threat models and controls for agent‑specific failure modes - prompt injection, tool misuse, excessive agency, data exfiltration through context, unsafe autonomy, and supply chain risk in model and plugin ecosystems.
• Performing automated application and API penetration testing against our own products - web, mobile backends, cloud‑native services on GCP, internal tooling, and AI features.
• Leading penetration engagements with third parties and working on the fix with engineering.
• Chaining findings into realistic attack paths and demonstrating impact, rather than delivering a list of scanner output.
• Embedding security into our pipelines: SAST, SCA, secrets detection, IaC scanning, container and dependency hygiene - tuned so signal beats noise and engineers trust the gates.
• Working with platform and engineering to raise baseline standards: authentication and authorisation patterns, secrets management, tenancy isolation, and logging and detection coverage.
• Actively participating in the security community - OWASP chapters or projects, local meetups, CTFs, research groups - and publishing research, write‑ups, or blog posts under your own name.

We're looking for someone who:

• Brings substantial hands‑on application security experience in a product engineering environment, at senior level.
• Has demonstrable threat modelling practice - not just familiarity with the theory.
• Has practical offensive skills against modern web and API stacks, with an appropriate certification or equivalent demonstrable experience (OSCP, OSWE, CREST, Burp Suite Certified Practitioner or similar).
• Is comfortable reading and reasoning about code in at least one language used in production systems, and can review a pull request meaningfully.
• Has working knowledge of cloud‑native architecture and its security model - ideally GCP, but AWS or Azure experience transfers.
• Has experience integrating security tooling into CI/CD, and the scars to know what makes engineers ignore it.
• Has a track record of shipping security improvements through other teams.
• Has experience securing AI or agentic systems in production.
• Has hands‑on experience securing Kubernetes environments and managing cl