Staff Product Security Engineer

About the role

Altium 365, the cloud platform behind Altium 365 Software Engineering, is looking for a Staff Product Security Engineer to strengthen its product security capability with a strong focus on continuous vulnerability discovery and prevention. The role ensures that existing functionality and new changes stay secure over time, finding real vulnerabilities before customers do.

Key responsibilities

• Security regression testing: design and maintain test suites covering critical flows, integrate them into CI/CD pipelines, and define coverage targets for authentication, access control, APIs and data flows
• Threat modeling: run sessions on existing components and new features, identify attack surfaces and abuse cases, and turn threats into test cases, security requirements and mitigation plans
• Offensive security: perform manual and automated testing simulating attackers, validate exploitability and business impact, and partner with engineering teams to reproduce issues, prioritize fixes and validate remediation
• Vulnerability discovery: continuously assess the platform against the OWASP Top 10, going beyond DAST/SAST tools to find logic flaws and abuse paths
• Security assurance: review new features for security risks and act as a security gatekeeper while enabling teams with guidance and tooling
• Collaboration: work with engineering, architecture and SRE / platform teams, contribute to secure-by-design practices and help scale security through reusable patterns, automation and guidance

Required profile

• 5+ years in application / product security
• Bachelor's degree or equivalent of 12 years of work experience
• Ability to identify business logic vulnerabilities
• Preferred: background in software engineering (reading and writing code)

Required skills

• Web application security testing and API security
• Threat modeling and OWASP Top 10
• Manual penetration testing and security regression testing
• CI/CD security integration
• Preferred: SaaS / multi-tenant platforms, bug bounty programs, red teaming, security automation frameworks, AWS, identity systems (SSO, MFA)