Senior Product Security Engineer — Shape Secure by Design

Trainline; Greater London; Hybrid; GBP 90,000 - 120,000; Full time

Benefits offered by this job

Private healthcare

Dental insurance

Hybrid work model

Salary progression

Job summary

Trainline is seeking a Senior Product Security Engineer to own product security across the development lifecycle, partnering with SRE and Platform Engineering to embed security into design, build and deploy practices.

You will lead threat modelling, vulnerability management, code reviews, and security testing across web, mobile and API services, mentoring engineers and aligning with OWASP, ISO 27001, GDPR and PCI DSS. The role is hybrid with a strong emphasis on secure development culture.

Qualifications

• Significant experience identifying and mitigating security risks across app design, code and deployed products.
• Experience shaping and delivering a product security roadmap with metrics to show progress and risk reduction.
• Experience securing mobile apps and APIs, including OAuth 2.0 and OpenID Connect.
• Hands-on with security testing tools such as SAST, DAST and vulnerability scanning.
• Threat modelling and security reviews with third-party penetration tests and architects.

Responsibilities

• Define and own the product security roadmap aligned with business goals.
• Establish and own the application security vulnerability management process from triage to remediation tracking.
• Carry out threat modelling for web, mobile and API services to identify risks and apply countermeasures.
• Assess security posture via code reviews, SAST/DAST, and manage third-party tests.
• Strengthen security of iOS/Android apps and APIs, including authentication and data protection.
• Automate security tools to support safe development and operations across CI/CD.
• Build secure coding and deployment knowledge through training and a security champions program.
• Align practices with OWASP, NIST, ISO 27001, GDPR and PCI DSS.

Skills

Application security

Threat modelling

Security testing

CI/CD security

Secure coding practices

Regulatory compliance

Tools

SAST

DAST

Vulnerability scanners

Mobile app security testing

API security testing

Job description

Trainline is seeking a Senior Product Security Engineer to own product security across the development lifecycle, partnering with SRE and Platform Engineering to embed security into design, build and deploy practices.

You will lead threat modelling, vulnerability management, code reviews, and security testing across web, mobile and API services, mentoring engineers and aligning with OWASP, ISO 27001, GDPR and PCI DSS. The role is hybrid with a strong emphasis on secure development culture.