Product security engineer for cloud platforms

Renesas Electronics; Lisboa; On-site; EUR 70,000 - 100,000; Full time

Job summary

Renesas Electronics Corp. ищет старшего инженера по безопасности продукта для расширения возможностей защиты и предотвращения уязвимостей в облачной платформе.

Кандидат будет заниматься регрессионным тестированием безопасности, threat modeling и участие в CI/CD процессах, работая с командами разработки и архитектуры.

Qualifications

• 5+ лет в области безопасности приложений/продукта.
• Опыт тестирования веб-приложений, API-безопасности, threat modeling
• Глубокое понимание OWASP Top 10
• Опыт ручного пентестинга и CI/CD влияния на безопасность

Responsibilities

• Строить и выполнять регрессионное тестирование безопасности.
• Водить моделирование угроз для существующих и новых функций.
• Проводить целевые offensive security активности (Red Team).
• Идентифицировать реальные уязвимости на основе OWASP Top 10.
• Разрабатывать и поддерживать наборы тестов регресcии безопасности.
• Интегрировать тесты в CI/CD пайплайны.
• Определять охват для критических зон (авторизация, API, потоки данных).
• Проводить структурированные сессии threat modeling.
• Проверять новые функции на риски безопасности.

Skills

Security testing

Threat modeling

OWASP Top 10

Penetration testing

CI/CD security

Authentication & Authorization

Cloud-native systems

Education

Bachelor's Degree or equivalent

Tools

AWS

IAM / SSO / MFA

Security automation frameworks

Job description

Описание

Build the cloud platform that’s transforming electronics design. Altium 365 for cloud lets design engineers communicate, collaborate and bring their ideas to market more efficiently than any platform in the industry. We are looking for a Senior Product Security Engineer to extend our Product Security capability with a strong focus on continuous vulnerability discovery and prevention.

Задачи

• Building and executing security regression testing
• Driving threat modeling across existing and new functionality
• Conducting targeted offensive security activities (Red Team–style testing)
• Identifying real vulnerabilities based on a deep understanding of our platform and the OWASP Top 10 Web Application Security Risks
• Design and maintain security regression test suites covering critical application flows
• Ensure vulnerabilities, once fixed, are permanently prevented from recurring
• Integrate security regression into CI/CD pipelines
• Define coverage targets for security-critical areas (auth, access control, APIs, data flows)
• Lead structured threat modeling sessions for existing system components and new features and architectural changes
• Identify attack surfaces, abuse cases, and trust boundaries
• Translate threats into test cases, security requirements, mitigation plans
• Ensure threat modeling becomes a continuous lifecycle activity
• Perform manual and automated security testing simulating real attacker behavior
• Focus on high-impact vulnerabilities, not theoretical findings
• Validate exploitability and business impact
• Partner with engineering teams to reproduce issues, prioritize fixes, validate remediation
• Continuously assess the platform against OWASP Top 10 categories
• Use deep product knowledge to find non-obvious, context-specific vulnerabilities
• Go beyond tooling (DAST/SAST) to uncover logic flaws and abuse paths
• Review new features and changes for security risks
• Ensure all changes are threat-modeled and covered by regression tests
• Act as a security gatekeeper without becoming a bottleneck: enable teams with guidance and tooling; avoid heavy process overhead
• Work closely with engineering teams, architecture, SRE / Platform teams
• Contribute to secure-by-design practices
• Support developers in understanding and fixing vulnerabilities

Требования

• 5+ years in Application / Product Security Bachelor's Degree or equivalent of 12 years of work experience
• Strong hands-on experience in web application security testing, API security, threat modeling methodologies
• Deep understanding of OWASP Top 10
• Experience with manual penetration testing, security regression testing, CI/CD security integration
• Ability to identify business logic vulnerabilities
• Strong understanding of authentication, authorization, and session management, multi-tenant architectures, cloud-native systems
• Будет плюсом: Experience in SaaS / multi-tenant platforms; Familiarity with bug bounty programs, red teaming, security automation frameworks; Knowledge of AWS; Identity systems and federation (SSO, MFA); Background in software engineering (ability to read/write code)

Условия

We believe in rewarding our employees with a competitive benefits package alongside their salary. More information will be provided during the hiring process.