Senior Product Security Engineer

Senior Product Security Engineer** (Contract)

Duration: 8 Months (Possibility for extension)

Location: London/Hybrid (2 days per week on site)

Rate: A highly competitive Umbrella Day Rate is available for suitable candidates

Role Overview

As a Senior Product Security Engineer, you will be an essential partner in embedding security practices throughout the entire product lifecycle-from design and development to deployment and maintenance. Your collaboration with engineering, product management, and compliance teams will ensure our products are not only secure by design but also resilient in production environments.

Key Responsibilities:

Security Policy Development: Define and implement robust security policies and tooling across the product lifecycle, ensuring security is integrated from the ground up.
Threat Modeling Leadership: Lead threat modeling sessions for both new and existing applications, guiding teams to ensure documented and actionable outputs.
Vulnerability Management: Oversee the product vulnerability backlog by prioritizing the remediation of high and critical vulnerabilities, and track key metrics such as open vulnerabilities and SLA compliance.
Bug Bounty Coordination: Manage findings from bug bounty programs and ensure timely remediation of identified issues.
Root Cause Analysis: Conduct thorough root cause analysis for security incidents and systemic vulnerabilities, leveraging insights to drive developer training and systemic improvements.
Incident Response Management: Act as Investigation Lead or Incident Commander during incident response efforts, including facilitating tabletop exercises to enhance our incident readiness.

Skills & Experience:

Expertise: Deep knowledge in vulnerability management, threat modeling, security architecture, and secure software development lifecycle (SDLC) practices.
Incident Response Skills: Strong background in incident response, root cause analysis, and managing bug bounty programs.
Communication Ability: Excellent communication and stakeholder management skills, with proven experience in driving cross-functional initiatives.
Risk Management Experience: Familiarity with third-party risk management, security assessments, and regulatory compliance.
Technical Proficiency: Experience working with CI/CD teams to implement security technologies in the pipeline, including SAST, DAST, and SCA tools.
Collaborative Spirit: A track record of partnering with cross-functional teams to deliver impactful security initiatives.

Candidates will need to show evidence of the above in their CV in order to be considered.

If you feel you have the skills and experience and want to hear more about this role 'apply now' to declare your interest in this opportunity with our client. Your application will be observed by our dedicated team.

We will respond to all successful applicants ASAP however, please be advised that we will always look to contact you further from this time should we need further applicants or if other opportunities arise relevant to your skillset.

Pontoon is an employment consultancy. We put expertise, energy, and enthusiasm into improving everyone's chance of being part of the workplace. We respect and appreciate people of all ethnicities, generations, religious beliefs, sexual orientations, gender identities, and more. We do this by showcasing their talents, skills, and unique experience in an inclusive environment that helps them thrive.

As part of our standard hiring process to manage risk, please note background screening checks will be conducted on all hires before commencing employment.

We use generative AI tools to support our candidate screening process. This helps us ensure a fair, consistent, and efficient experience for all applicants. Rest assured, all final decisions are made by our hiring team, and your application will be reviewed with care and attention