Senior Product Security Engineer - Secure by Design Leader

Trainline; Greater London; Hybrid; GBP 90,000 - 100,000; Full time

Benefits offered by this job

Private healthcare

Dental insurance

Work from abroad policy

2-for-1 share purchase plans

EV Scheme

Job summary

Trainline is seeking a Senior Product Security Engineer to own product security across the development lifecycle, partnering with SRE and Platform Engineering to embed secure practices. You will define the security roadmap, manage vulnerability processes, and perform threat modelling for web, mobile and API services.

This role strengthens apps and APIs with robust authentication, authorization and threat mitigation in a hybrid London-based team.

Qualifications

• Experience defining and delivering a product security roadmap and influencing engineering leaders.
• Experience establishing and owning application security vulnerability management processes with metrics.

Responsibilities

• Define and own the product security roadmap, aligning priorities with business goals.
• Establish and own the application security vulnerability management process from triage to remediation tracking.
• Perform threat modelling for web, mobile, and API services and implement effective countermeasures.
• Assess security posture via code reviews, SAST/DAST, and manage third-party pen tests with remediation tracking.
• Strengthen security across iOS and Android apps and their APIs including authentication/authorization controls.
• Automate and maintain security tooling to support safe development and operations (ASPM, SCA, etc.).
• Drive secure coding/deployment knowledge with training and a security champions programme.
• Ensure practices align with OWASP, NIST, ISO 27001, GDPR, PCI DSS and monitor emerging threats.

Skills

Product security roadmap

Threat modelling

Code reviews

Automation in CI/CD

Tools

SAST

DAST

Vulnerability scanning

OAuth 2.0

OpenID Connect

Job description

Trainline is seeking a Senior Product Security Engineer to own product security across the development lifecycle, partnering with SRE and Platform Engineering to embed secure practices. You will define the security roadmap, manage vulnerability processes, and perform threat modelling for web, mobile and API services.

This role strengthens apps and APIs with robust authentication, authorization and threat mitigation in a hybrid London-based team.