Senior Product Security Engineer - Secure by Design Leader

Numan; Greater London; On-site; GBP 90,000 - 120,000; Full time

Job summary

Numan is building a regulated digital health platform with a security‑minded, hands‑on senior engineer role. You will own threat modelling, secure by design, and practical controls across web, API, and AI features, collaborating with Engineering, Product, Clinical, and Legal to scale security through the organization.

You’ll lead automated testing, secure design reviews, and integration of security tooling into CI/CD, Kubernetes environments, and cloud services, with a strong focus on protecting

Qualifications

• Senior level with hands-on application security in a product engineering environment.
• Demonstrated threat modelling practice in real projects.
• Offensive security skills for modern web and API stacks; relevant certification or equivalent experience.
• Ability to read production code and meaningfully review pull requests.
• Knowledge of cloud-native security models; preference for GCP, AWS/Azure acceptable.
• Experience embedding security tooling into CI/CD pipelines.

Responsibilities

• Run threat modelling sessions with product and engineering on new features and architecture.
• Own and advance Secure by Design processes and threat modelling pathways.
• Translate threat models into prioritized, implementable controls for engineering teams.
• Drive upstream design decisions to prevent costly fixes later.
• Assess and secure AI systems in production, including LLMs and agentic workflows.
• Build threat models for agent-specific risks such as prompt injection and data exfiltration.
• Perform automated application and API penetration testing across web, mobile, and cloud services.
• Lead third-party penetration engagements and remediate findings with engineering.
• Embed security into pipelines: SAST, SCA, secrets detection, IaC, container hygiene.

Skills

Application security

Threat modelling

Offensive security

Code review

Cloud security (GCP/AWS/Azure)

CI/CD security

AI/security in production

Kubernetes security

Tools

Burp Suite

OWASP ZAP

GCP

Job description

Numan is building a regulated digital health platform with a security‑minded, hands‑on senior engineer role. You will own threat modelling, secure by design, and practical controls across web, API, and AI features, collaborating with Engineering, Product, Clinical, and Legal to scale security through the organization.

You’ll lead automated testing, secure design reviews, and integration of security tooling into CI/CD, Kubernetes environments, and cloud services, with a strong focus on protecting