Description review
Senior Product Security Engineer
payabl. · Portugal · back to the listing
HR standards
67/100
needs work
Title ↔ description
93/100
strong
Reads as
Security Engineer
100% confident
What this role officially is
ICT security administrator — ESCO, the EU occupation classification
ICT security administrators plan and carry out security measures to protect information and data from unauthorised access, deliberate attack, theft and corruption.
Also known as: network security administrator, system security administrator, ICT security administrators, IT security administrator
How others title the same work
Large employers
- Security Risk Management Specialist Canonical Ltd.
- Security Software Engineer Canonical Ltd.
- Senior Security Operations Engineer Canonical Ltd.
- Staff Security Operations Engineer Canonical Ltd.
- Ubuntu Security Engineer Canonical Ltd.
Startups
- Security Engineer (Bangalore, India) AiPrise
- Security & Trust Engineer Alex
- Elucid | Senior Security Engineer | Boston, MA | ONSITE (hybrid) | $130k–$170k Elucid
- Factory | Security Engineer | ONSITE, San Francisco, CA | Full-Time Factory
- Factory | Security Engineer | Onsite in San Francisco | Full-time Factory
What the listing never says
- 33 bullet points. Long requirement lists deter qualified candidates, who read them as hard gates. Scope clarity
- No pay range published. Candidates cannot tell whether applying is worth their time. Pay transparency
The listing, marked up
Nothing in the wording of this listing tripped a check. The scores above still judge how complete and coherent it is.
The role is about:
We are looking for a Senior Product Security Engineer to build product security across our engineering organization. You will build the practice, not inherit it. Reporting to the Head of Information Security, you will embed security directly into the software development lifecycle — from architecture and design through build, deployment, and remediation. You will introduce security gates into engineering workflows, select and operate the right application security tooling, and use AI and automation to increase security coverage without slowing product delivery.
• Location: Fully remote from Portugal or Poland
• Reporting to: Head of Information Security
What you will do:
• Design and introduce security gates into the development lifecycle, including embeded secure release practices and guardrails into the way software is built and deployed.
• Lead threat modelling for new products and major changes
• Provide secure-by-design input for new product builds across card issuing, embedded finance / banking-as-a-service, and other payment products
• Define secure-by-default architecture patterns for the application layer — authentication, authorization, API design, service-to-service trust — so the secure path is the easiest path for engineering teams
• Decide where traditional tooling is the right fit and where AI-assisted alternatives provide better coverage or efficiency
• Own CI/CD pipeline and software supply-chain security controls across engineering teams
• Implement and improve container image scanning, dependency management, software bill of materials, and security checks on infrastructure-as-code and deployment manifests
• Build the practice AI-first - introduce AI agents and LLM-assisted workflows the default delivery mechanism for application security
• Drive remediation of application-layer findings with engineering teams, including findings from penetration tests, scanners, and disclosure reports
What we need:
• 5+ years of experience in Product Security, Application Security in payments, fintech, banking, e-money, or another fintech product environment
• Strong hands-on experience embedding security into the software development lifecycle
• You read code comfortably and hold your own in design discussions with senior engineers
• Proven experience with threat modelling, secure-by-design reviews, and working with engineers during architecture and delivery stages
• Hands-on experience with application security tooling such as SAST, SCA, secrets detection, and DAST
• Hands-on experience securing cloud-native applications on AWS or other major cloud
• Strong AI proficiency and hands-on experience (agentic workflows and loops, RAG, MCP, etc)
• Solid understanding of Cloud-first environment and modern development practices
• Experience securing CI/CD pipelines and improving software supply-chain security
• Ability to work directly with engineering teams and influence secure delivery in practice, not just through policy
• Strong ownership mindset — able to define, implement, improve, and drive adoption of security practices across multiple teams
• Strong written and verbal English
Nice to have:
• Experience supporting new product launches in cloud-native or API-driven environments
• Detection-as-code or security-as-code mindset
• Penetration-testing or offensive-security background
• Certifications such as CISSP, CSSLP, CCSP, OSCP, or similar
Hiring Process:
•
Step 1 – Thinking in Action (40 minutes) Your first conversation will be with our Talent Acquisition team. We'll explore your background, career journey, motivations, and overall fit for the role. As part of this discussion, you'll also complete a short technical screening that will be reviewed by our engineering team. This stage helps us understand both your experience and how you approach technical challenges.
•
Step 2 – Hiring Manager interview (60-minutes) you will meet the hiring manager Head of Information Security, to explore your skills, achievements, and alignment with the role.
•
Step 3 – Final Interview (45 minutes) The final stage is a group interview with senior members of our Technology squad, which may include the CTO, CPO and Head of Security. Together, we'll discuss team fit, collaboration style, expectations from both sides, and any remaining questions about the role, team, or technology domain. This is also an opportunity for you to learn more about our culture and ways of working.
The perks of being a payabl.er:
•
Grow with Us: Annual Learning Budget for professional development (eligible after probation)—because your growth is our growth.
•
Celebrate Together: We bring colleagues from all offices together for unforgettable company celebrations.
•
Global Collaboration & Events: Opportunities to participate in international company events and initiatives, connecting with colleagues from all regions and contributing to a truly global community
Let's embark on a journey to redefine the landscape of payments together. We're not just offering a role; we're inviting you to be a part of something bigger. Join our team, and let's innovate, disrupt, and lead the future of payments. Together, we can make an impact that resonates. Welcome to the team!
Please review our Privacy Policy to understand how we process your personal data during the recruitment process:
Originally posted on Himalayas
We are looking for a Senior Product Security Engineer to build product security across our engineering organization. You will build the practice, not inherit it. Reporting to the Head of Information Security, you will embed security directly into the software development lifecycle — from architecture and design through build, deployment, and remediation. You will introduce security gates into engineering workflows, select and operate the right application security tooling, and use AI and automation to increase security coverage without slowing product delivery.
• Location: Fully remote from Portugal or Poland
• Reporting to: Head of Information Security
What you will do:
• Design and introduce security gates into the development lifecycle, including embeded secure release practices and guardrails into the way software is built and deployed.
• Lead threat modelling for new products and major changes
• Provide secure-by-design input for new product builds across card issuing, embedded finance / banking-as-a-service, and other payment products
• Define secure-by-default architecture patterns for the application layer — authentication, authorization, API design, service-to-service trust — so the secure path is the easiest path for engineering teams
• Decide where traditional tooling is the right fit and where AI-assisted alternatives provide better coverage or efficiency
• Own CI/CD pipeline and software supply-chain security controls across engineering teams
• Implement and improve container image scanning, dependency management, software bill of materials, and security checks on infrastructure-as-code and deployment manifests
• Build the practice AI-first - introduce AI agents and LLM-assisted workflows the default delivery mechanism for application security
• Drive remediation of application-layer findings with engineering teams, including findings from penetration tests, scanners, and disclosure reports
What we need:
• 5+ years of experience in Product Security, Application Security in payments, fintech, banking, e-money, or another fintech product environment
• Strong hands-on experience embedding security into the software development lifecycle
• You read code comfortably and hold your own in design discussions with senior engineers
• Proven experience with threat modelling, secure-by-design reviews, and working with engineers during architecture and delivery stages
• Hands-on experience with application security tooling such as SAST, SCA, secrets detection, and DAST
• Hands-on experience securing cloud-native applications on AWS or other major cloud
• Strong AI proficiency and hands-on experience (agentic workflows and loops, RAG, MCP, etc)
• Solid understanding of Cloud-first environment and modern development practices
• Experience securing CI/CD pipelines and improving software supply-chain security
• Ability to work directly with engineering teams and influence secure delivery in practice, not just through policy
• Strong ownership mindset — able to define, implement, improve, and drive adoption of security practices across multiple teams
• Strong written and verbal English
Nice to have:
• Experience supporting new product launches in cloud-native or API-driven environments
• Detection-as-code or security-as-code mindset
• Penetration-testing or offensive-security background
• Certifications such as CISSP, CSSLP, CCSP, OSCP, or similar
Hiring Process:
•
Step 1 – Thinking in Action (40 minutes) Your first conversation will be with our Talent Acquisition team. We'll explore your background, career journey, motivations, and overall fit for the role. As part of this discussion, you'll also complete a short technical screening that will be reviewed by our engineering team. This stage helps us understand both your experience and how you approach technical challenges.
•
Step 2 – Hiring Manager interview (60-minutes) you will meet the hiring manager Head of Information Security, to explore your skills, achievements, and alignment with the role.
•
Step 3 – Final Interview (45 minutes) The final stage is a group interview with senior members of our Technology squad, which may include the CTO, CPO and Head of Security. Together, we'll discuss team fit, collaboration style, expectations from both sides, and any remaining questions about the role, team, or technology domain. This is also an opportunity for you to learn more about our culture and ways of working.
The perks of being a payabl.er:
•
Grow with Us: Annual Learning Budget for professional development (eligible after probation)—because your growth is our growth.
•
Celebrate Together: We bring colleagues from all offices together for unforgettable company celebrations.
•
Global Collaboration & Events: Opportunities to participate in international company events and initiatives, connecting with colleagues from all regions and contributing to a truly global community
Let's embark on a journey to redefine the landscape of payments together. We're not just offering a role; we're inviting you to be a part of something bigger. Join our team, and let's innovate, disrupt, and lead the future of payments. Together, we can make an impact that resonates. Welcome to the team!
Please review our Privacy Policy to understand how we process your personal data during the recruitment process:
Originally posted on Himalayas