Staff Product Security Engineer

About the role

We are looking for a Senior Product Security Engineer to strengthen Altium 365’s security posture. The role focuses on continuous vulnerability discovery, prevention, and ensuring secure product evolution.

Key responsibilities

• Build and execute security regression test suites for critical application flows and integrate them into CI/CD pipelines.
• Define coverage targets for security‑critical areas such as authentication, access control, APIs and data flows.
• Lead structured threat‑modeling sessions for existing components and new features, translating threats into test cases, security requirements and mitigation plans.
• Conduct manual and automated Red‑Team style testing, focusing on high‑impact vulnerabilities and validating exploitability and business impact.
• Continuously assess the platform against the OWASP Top 10, uncovering logic flaws and abuse paths beyond standard DAST/SAST tools.
• Review new product changes for security risks, ensuring they are threat‑modeled, covered by regression tests and act as a security gatekeeper without creating bottlenecks.
• Collaborate with engineering, architecture and SRE teams to embed secure‑by‑design practices and provide guidance and reusable automation patterns.

Required profile

• Minimum 5 years of experience in application or product security.
• Bachelor’s degree or equivalent experience (12 years of work experience).
• Proven hands‑on experience with web application security testing, API security, threat modeling and Red‑Team activities.
• Deep knowledge of the OWASP Top 10 and experience driving vulnerability discovery in complex cloud platforms.

Required skills

• Web application security testing
• API security testing
• Threat modeling methodologies
• OWASP Top 10 expertise
• Security regression testing
• CI/CD pipeline integration
• Red‑Team / offensive security testing
• Manual and automated security testing tools (DAST, SAST, etc.)