Staff Product Security Engineer

Arm Limited; Cambridge; Hybrid; GBP 70,000 - 110,000; Full time

Job summary

Arm in Cambridge is seeking a Product Security Engineer to join the Product Security Incident Response Team. You will coordinate vulnerability handling, remediation, and responsible disclosure across Arm products and technologies.

You will work with engineering, legal, communications, researchers, customers and partners to triage, assess, and respond to vulnerabilities, while improving PSIRT processes and strengthening security across a global technology ecosystem.

Qualifications

• Experience in PSIRT or vulnerability disclosure triage.
• Knowledge of CVE processes and severity scoring.
• Ability to communicate across technical and non-technical teams.

Responsibilities

• Drive triage, assessment, and resolution of product security vulnerabilities.
• Lead and coordinate product security incident response across teams.
• Own coordinated vulnerability disclosure activities including CVE assignment.
• Represent Arm in security engagements with researchers and customers.
• Support and evolve Arm's bug bounty programs and researcher engagement.
• Improve PSIRT processes, tooling, metrics, and incident response.
• Safeguard integrity and confidentiality of vulnerability handling.

Skills

PSIRT experience

CVE process knowledge

Vulnerability coordination

Clear communication

Tools

Bug bounty programs

Security incident tooling

Job description

Arm is looking for a Product Security Engineer to join our Product Security Incident Response Team. This role will support the handling, coordination, and disclosure of security vulnerabilities affecting Arm products and technologies.

You will work closely with engineering, architecture, legal, communications, customer-fac­ing teams, researchers, partners, and industry bodies to assess reported vulnerabilities, coordinate remediation activity, and support responsible disclosure.

Key Responsibilities

• Drive the triage, assessment, and resolution of product security vulnerabilities across Arm hardware and software.
• Lead and coordinate product security incident response, working across engineering teams, business functions, customers, and industry partners.
• Own coordinated vulnerability disclosure activities, including disclosure strategy, timelines, customer communications, CVE assignment, and security advisory publication.
• Represent Arm in security engagements with researchers, customers, partners, and the wider security community.
• Support and evolve Arm's bug bounty programs, ensuring high-quality vulnerability assessment, researcher engagement, and effective internal coordination.
• Strengthen Arm's product security capability through continuous improvement of PSIRT processes, tooling, metrics, and incident response practices.
• Safeguard the integrity and confidentiality of vulnerability handling, ensuring responses are accurate, timely, and aligned with industry best practice.

Required Experience

• Previous experience working in a PSIRT, vulnerability disclosure, or bug bounty triage role.
• Working knowledge of CVE processes, vulnerability advisories, severity assessment, and remediation coordination.
• Ability to communicate clearly with both technical and non-technical collaborators, working across different teams and priorities in time-sensitive situations.

Desirable Experience

• Experience with hardware and/or software vulnerability handling.
• Experience working with or supporting a bug bounty program.
• Familiarity with performing vulnerability severity scoring such as CVSS.
• Understanding of secure development practices, product security risk management, or security architecture.
• Experience engaging with external researchers, customers, CERTs, CVE/CNA programs, or industry security communities.

About You

You are pragmatic, collaborative, and calm under pressure. You understand the importance of trust, confidentiality, and clear communication in vulnerability handling. You can balance technical accuracy with practical coordination, and you are motivated by helping teams respond effectively to product security issues.

You are excited by the opportunity to help secure the technologies shaping the future of AI and computing at Arm - a world-leading organisation whose technology powers billions of devices, from tiny microcontrollers and everyday smartphones to the systems at the heart of advanced data centres. You want to work alongside exceptional engineers and researchers, deepen your expertise through technically challenging work, and see your contribution strengthen security across a global technology ecosystem.

Our 10x Mindset

At Arm, we believe progress happens when people are empowered to think bigger and push beyond what seems possible. Our 10x mindset is about curiosity, ambition and creating impact that will be used by millions. We learn fast, prioritise collaboration and turn bold ideas into real technology. We look for people who are inspired by this way of working and want to grow in an environment where bold ideas are welcomed. Discover how the 10x mindset shapes life at Arm: https://careers.arm.com/10x-mindset

Use of AI in Your Application

At Arm, we embrace the benefits AI can bring, including in recruitment. You may use AI to support your preparation, such as improving the clarity of written responses, practicing interview questions, or learning more about our industry. However, your application and interview responses must reflect your own thinking, experience, and abilities. We want to understand your authentic perspective, creativity, and approach to problem solving. As such, you may not use AI to complete assigned tasks as part of any assessments. If you plan to use AI-supported or assistive technologies as part of a reasonable adjustment, please contact [e-mail] so we can support you.

Recruitment Adjustments and Accommodations

At Arm, we want to build extraordinary teams. If you need an adjustment or an accommodation during the recruitment process, please email [e-mail]. To note, by sending us the requested information, you consent to its use by Arm to arrange for appropriate accommodations. All accommodation or adjustment requests will be treated with confidentiality, and information concerning these requests will only be disclosed as necessary to provide the accommodation. Although this is not an exhaustive list, examples of support include breaks between interviews, having documents read aloud, or office accessibility. Please email us about anything we can do to accommodate you during the recruitment process.

Hybrid Working

Arm's approach to hybrid working is designed to create a working environment that supports both high performance and personal wellbeing. We believe in bringing people together face to face to enable us to work at pace, whilst recognizing the value of flexibility. Within that framework, we empower groups/teams to determine their own hybrid working patterns, depending on the work and the team’s needs. Details of what this means for each role will be shared upon application. In some cases, the flexibility we can offer is limited by local legal, regulatory, tax, or other considerations, and where this is the case, we will collaborate with you to find the best solution. Please talk to us to find out more about what this could look like for you.

Equal Opportunities

Arm is an equal opportunity employer, committed to providing an environment of mutual respect where equal opportunities are available to all applicants and colleagues. We are a diverse organization of dedicated and innovative individuals, and don’t discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.