Senior Product Security Engineer

payabl.; Polska; Presencial; PLN 150.000 - 210.000; Jornada completa

Descripción de la vacante

payabl. is seeking a Senior Product Security Engineer to build security into the software lifecycle across our engineering teams. You will design gates, embed secure release practices, and lead threat modelling to harden payment products.

This role focuses on secure-by-design architectures, CI/CD and supply-chain security, SBOM, container scanning, and AI-assisted workflows to scale security without slowing delivery.

Formación

• Experience embedding security into the software development lifecycle.
• Proven ability to design secure-by-default architectures.
• Hands-on with CI/CD pipelines and software supply-chain security.
• Familiar with threat modelling and security gate design.

Responsabilidades

• Design and introduce security gates into the development lifecycle, including embeded secure release practices and guardrails into the way software is built and deployed.
• Lead threat modelling for new products and major changes
• Provide secure-by-design input for new product builds across card issuing, embedded finance / banking-as-a-service, and other payment products
• Define secure-by-default architecture patterns for the application layer — authentication, authorization, API design, service-to-service trust — so the secure path is the easiest path for engineering teams
• Decide where traditional tooling is the right fit and where AI-assisted alternatives provide better coverage or efficiency
• Own CI/CD pipeline and software supply-chain security controls across engineering teams
• Implement and improve container image scanning, dependency management, software bill of materials, and security checks on infrastructure-as-code and deployment manifests
• Build the practice AI-first - introduce AI agents and LLM-assisted workflows the default delivery mechanism for application security
• Drive remediation of application-layer findings with engineering teams, including findings from penetration tests, scanners, and disclosure reports

Conocimientos

Threat modelling

Secure-by-design

CI/CD security

SBOM

IaC security

AI-assisted security

Container security

DevSecOps

Security design

Herramientas

Security tooling

LLM workflows

Container scanning tools

Descripción del empleo

We are looking for a Senior Product Security Engineer to build product security across our engineering organization. You will build the practice, not inherit it. Reporting to the Head of Information Security, you will embed security directly into the software development lifecycle — from architecture and design through build, deployment, and remediation. You will introduce security gates into engineering workflows, select and operate the right application security tooling, and use AI and automation to increase security coverage without slowing product delivery.

What you will do:

• Design and introduce security gates into the development lifecycle, including embeded secure release practices and guardrails into the way software is built and deployed.
• Lead threat modelling for new products and major changes
• Provide secure-by-design input for new product builds across card issuing, embedded finance / banking-as-a-service, and other payment products
• Define secure-by-default architecture patterns for the application layer — authentication, authorization, API design, service-to-service trust — so the secure path is the easiest path for engineering teams
• Decide where traditional tooling is the right fit and where AI-assisted alternatives provide better coverage or efficiency
• Own CI/CD pipeline and software supply-chain security controls across engineering teams
• Implement and improve container image scanning, dependency management, software bill of materials, and security checks on infrastructure-as-code and deployment manifests
• Build the practice AI-first - introduce AI agents and LLM-assisted workflows the default delivery mechanism for application security
• Drive remediation of application-layer findings with engineering teams, including findings from penetration tests, scanners, and disclosure reports