Senior Product Security Engineer - Drive Secure by Design

Trainline plc; Greater London; Hybrid; GBP 90,000 - 150,000; Full time

Benefits offered by this job

Private healthcare

Dental insurance

Work from abroad policy

Share purchase plan

EV scheme

Festive time off

Family-friendly benefits

Job summary

Trainline plc is seeking a Senior Product Security Engineer to own product security across the development lifecycle, collaborating with SRE and Platform Engineering to embed security into every build.

You will own the application security roadmap, manage vulnerability processes, conduct threat modelling for web, mobile and API services, and drive secure coding practices across CI/CD pipelines with a focus on OWASP, NIST, ISO 27001, GDPR and PCI DSS.

Qualifications

• Significant experience identifying, assessing and mitigating security risks across design, code and deployed products.
• Experience shaping a product/security roadmap and using metrics to show risk reduction.
• Experience securing mobile apps and APIs, including OAuth/OpenID Connect.
• Hands-on with security testing tools (SAST/DAST, vulnerability scanning).
• Experience with threat modelling, security reviews and pen tests in partnership with teams.
• Secure coding practices and automation within CI/CD, across cloud/native infra.

Responsibilities

• Define and own the product security roadmap, aligning priorities with business goals.
• Establish and own vulnerability management across applications and APIs.
• Carry out threat modelling for web, mobile and API services and implement countermeasures.
• Assess security posture through code reviews, SAST/DAST and manage third-party tests.
• Strengthen iOS/Android app security and API gateway controls.
• Automate security tooling and work with engineering to prevent recurrences.
• Build security knowledge across the organisation with training and a champions programme.
• Ensure practices align with OWASP, NIST, ISO 27001, GDPR and PCI DSS.

Skills

Threat modelling

Vulnerability management

CI/CD security

Secure coding

Security testing

Leadership

Tools

SAST tools

DAST tools

Penetration testing

OAuth 2.0/OpenID Connect

Job description

Trainline plc is seeking a Senior Product Security Engineer to own product security across the development lifecycle, collaborating with SRE and Platform Engineering to embed security into every build.

You will own the application security roadmap, manage vulnerability processes, conduct threat modelling for web, mobile and API services, and drive secure coding practices across CI/CD pipelines with a focus on OWASP, NIST, ISO 27001, GDPR and PCI DSS.