Senior Product Security Engineer — Secure by Design at Scale

Remote Worker LTD.; Greater London; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Private healthcare

Work from abroad policy

Share purchase plan

EV scheme

Festive time off

Family-friendly benefits

Job summary

Trainline's Security Team seeks a Senior Product Security Engineer to own the product security roadmap across the development lifecycle. You will partner with SRE and Platform Engineering to embed security by design, protecting web, mobile, and API services while mentoring teams and driving automation.

This role requires hands-on expertise in vulnerability management, code reviews, and security testing. You will lead threat modelling, oversee third-party penetration tests, and strengthen app/API

Qualifications

• Significant experience shaping and delivering a product/application security roadmap.
• Experience securing mobile apps and APIs, including OAuth 2.0 and OpenID Connect.
• Hands-on with SAST/DAST and vulnerability scanning tools.

Responsibilities

• Define and own the product security roadmap aligned with business goals.
• Manage vulnerability management process and metrics like MTTR by severity.
• Carry out threat modelling for web, mobile and API services and implement countermeasures.
• Conduct code reviews and security testing of applications and APIs, coordinating third-party tests.
• Strengthen security of iOS/Android apps and APIs, including auth and data protection.
• Automate and maintain security tools across the SDLC and CI/CD pipelines.
• Build security knowledge across the organisation and grow a security champions programme.
• Ensure practices align with OWASP, NIST, ISO 27001, GDPR and PCI DSS.

Skills

Security risk assessment

Product security roadmap

Threat modelling

Mobile & API security

SAST/DAST testing

CI/CD security

Vulnerability management

Tools

OAuth 2.0/OpenID Connect

Penetration testing tools

Security testing tools

Job description

Trainline's Security Team seeks a Senior Product Security Engineer to own the product security roadmap across the development lifecycle. You will partner with SRE and Platform Engineering to embed security by design, protecting web, mobile, and API services while mentoring teams and driving automation.

This role requires hands-on expertise in vulnerability management, code reviews, and security testing. You will lead threat modelling, oversee third-party penetration tests, and strengthen app/API