Product Security Engineer

Aras Corporation; Poland; On-site; PLN 160,000 - 240,000; Full time

Job summary

Aras Corporation is seeking a Product Security Engineer to strengthen our secure DevOps practices in a Poland-based role. You will design and maintain secure CI/CD pipelines, embed security controls in the SDLC, and work across product, cloud, and DevOps teams to remediate risks at scale.

The role requires hands-on experience with SAST/DAST, container security, and cloud security in Azure and/or AWS, plus strong scripting abilities. A degree in CS or related field is expected.

Qualifications

• Experience designing and securing CI/CD pipelines.
• Hands-on scripting in Python or similar languages.
• Strong knowledge of cloud security and container security.
• Experience with Agile development and DevOps practices.

Responsibilities

• Design, develop, and maintain secure CI/CD pipelines using Jenkins, Kubernetes, Azure, and cloud-native technologies.
• Integrate security controls and automated security testing into the software delivery lifecycle.
• Implement and manage SAST, DAST, SCA, secrets detection, IaC scanning, container security, and software supply chain security controls.
• Drive security automation initiatives to reduce manual effort and accelerate secure software delivery.
• Document and verify the existing security mitigations and identify if additional mitigations are required for our products.
• Work with product development teams to guide mitigation development.
• Contribute to the development and implementation of security tests and verification protocols.

Skills

CI/CD pipelines

Python scripting

Cloud security

DevOps collaboration

Education

Bachelor’s degree in Computer Science or related field

Tools

Jenkins

Kubernetes

Azure

AWS

Terraform

SAST/DAST tools

Job description

Position: Product Security Engineer (m/f/d)

Location: Available to candidates located in Poland

Aras is expanding its Product Security team and is seeking a Product Security Engineer with strong DevOps expertise to help secure our products, cloud platforms, and software development lifecycle. This role will be responsible for designing, implementing, and maintaining secure CI/CD pipelines, integrating security controls throughout the development process, and driving a security-first engineering culture across product and cloud teams.

Part of the responsibilities would be the response to incidents, triage of found issues and communication with Product Development team on daily basis. As part of the Product Security organization, you will partner closely with software engineers, cloud architects, DevOps teams, and security stakeholders to identify, prioritize, and remediate security risks at scale. You will play a key role in advancing Aras' Security maturity. This position requires strong technical expertise, excellent communication skills, and hands-on experience integrating SAST, DAST, SCA, container security, and cloud security controls into modern CI/CD environments.

Key Responsibilities

• Design, develop, and maintain secure CI/CD pipelines using Jenkins, Kubernetes, Azure, and cloud-native technologies.
• Integrate security controls and automated security testing into the software delivery lifecycle.
• Implement and manage SAST, DAST, SCA, secrets detection, IaC scanning, container security, and software supply chain security controls.
• Drive security automation initiatives to reduce manual effort and accelerate secure software delivery.
• Document and verify the existing security mitigations and identify if additional mitigations are required for our products.
• Work with product development teams to guide mitigation development.
• Contribute to the development and implementation of security tests and verification protocols. Assist in conducting security verification and validation efforts.

Product Security

• Collaborate with product, development, and cloud engineering teams to embed security requirements throughout the SDLC.
• Conduct security reviews of applications, infrastructure, CI/CD workflows, and deployment architectures.
• Support threat modeling, risk assessments, and secure design reviews.
• Help establish security baselines, hardening standards, and secure deployment practices.

Engineering & Collaboration

• Develop automation solutions using Python, PowerShell, Bash, or Groovy.
• Provide expertise in Agile.
• Participate in daily standups, sprint planning, retrospectives, and collaborative design sessions.
• Continuously evaluate new tools, technologies, and approaches to improve security effectiveness and developer experience.

Required Qualifications

• 4+ years of hands-on experience with Jenkins or similar CI/CD platforms.
• 3+ years of software development, automation, or scripting experience using Python, PowerShell, Bash, or equivalent languages.
• Experience integrating security tooling into CI/CD pipelines, including SAST, DAST, SCA, container scanning, and secrets management.
• Working knowledge of cloud security principles and services in Azure and/or AWS.
• Understanding of containerized environments and Kubernetes security concepts.
• Experience collaborating with engineering teams in Agile development environments.
• Strong analytical, troubleshooting, and problem-solving skills.
• Self-motivated with the ability to work independently and manage multiple priorities.
• Bachelor’s degree in computer science, Information Technology, Cybersecurity, or equivalent practical experience.

Preferred Qualifications

• Experience with Infrastructure as Code (Terraform, Bicep, CloudFormation).
• Experience with Azure DevOps pipelines and security integrations.
• Familiarity with software supply chain security practices and frameworks (SBOM, SLSA, Sigstore, provenance validation).
• Experience securing Kubernetes and cloud-native platforms.
• Familiarity with AI-assisted development tools and secure AI engineering practices.
• Knowledge of security frameworks such as NIST SSDF, OWASP SAMM, OWASP ASVS, and CIS Benchmarks.

Certifications

One or more of the following certifications are highly desirable:

• Microsoft Certified: Azure Security Engineer Associate
• Microsoft Certified: DevOps Engineer Expert
• Certified Kubernetes Security Specialist (CKS)

What Success Looks Like

• Security controls are seamlessly integrated into engineering workflows with minimal developer friction.
• Vulnerabilities are identified and remediated earlier in the SDLC.
• Security testing and compliance checks are automated wherever possible.
• Product teams actively embrace DevSecOps and secure-by-design principles.
• Security becomes an engineering accelerator rather than a deployment bottleneck.