Senior Product Security Engineer — Secure-by-Design Leader

Trainline; Greater London; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Private healthcare

Dental insurance

Work from abroad policy

2-for-1 share purchase plans

EV Scheme

Festive time off

Family-friendly benefits

Job summary

Trainline in London is seeking a Senior Product Security Engineer to own product security across the development lifecycle, partnering with SRE and Platform Engineering to embed security into what we build. You'll act as a trusted bridge between security, engineering and the business to foster a secure-by-design culture.

You will lead the security roadmap, manage vulnerability processes, perform threat modelling for web, mobile and APIs, and drive secure coding and CI/CD automation.

Qualifications

• Significant experience defining and running application security programs.
• Experience shaping a product security roadmap and using metrics to show risk reduction.
• Hands-on security testing across web, mobile and APIs (SAST/DAST).
• Familiarity with OAuth2/OpenID Connect and third-party pen tests.

Responsibilities

• Define and own the product security roadmap, aligning with business goals and engineering leadership.
• Establish and own application security vulnerability management from triage to remediation.
• Lead threat modelling for web, mobile and API services and implement countermeasures.
• Assess security posture via code reviews and SAST/DAST testing; manage third-party pen tests.
• Strengthen security of iOS/Android apps and APIs, including authentication and data protection.
• Automate and maintain security tooling to support safe SDLC and CI/CD pipelines.
• Mentor teams, grow security champions, and ensure compliance with frameworks like OWASP, NIST, ISO 27001, GDPR, PCI DSS.

Skills

Vulnerability management

Threat modelling

Security testing

CI/CD security

Mobile app security

OAuth2/OpenID

OWASP/NIST/ISO27001

Tools

SAST

DAST

Penetration testing tools

Job description

Trainline in London is seeking a Senior Product Security Engineer to own product security across the development lifecycle, partnering with SRE and Platform Engineering to embed security into what we build. You'll act as a trusted bridge between security, engineering and the business to foster a secure-by-design culture.

You will lead the security roadmap, manage vulnerability processes, perform threat modelling for web, mobile and APIs, and drive secure coding and CI/CD automation.