Principal Engineer, Product Security
commercetools2 months ago
London, United KingdomStaff+
Responsibilities
- Formulate, evangelize, and drive adoption of the product security strategy.
- Assess and improve security maturity, architecture, operational practices, and technology-risk remediation.
- Educate product teams on risk assessments, threat modeling, and secure API-first applications.
- Review requirements and designs, embed security tooling into development, and support secure code review and static analysis implementations.
- Review external penetration-test results, investigate attack vectors, and help teams prioritize risk mitigation.
- Lead security and quality initiatives, certification-audit support, customer security conversations, and cross-organizational knowledge sharing.
- Collaborate with product teams, Product Management, Principal Engineers, and legal/compliance teams.
Requirements
- 5+ years of hands-on Product Security experience.
- 2+ years of experience improving Product Security in a leadership role.
- Experience with customer-facing security roles, roadmap influence in matrix organizations, and scale-up environments.
- Experience with secure architecture design reviews, threat modeling, SDLC security, static analysis, and secure code review implementations.
- Knowledge of Linux systems, Kubernetes, Terraform, Vault, API security, and web application security.
- Practical DevSecOps experience and proficiency in at least one scripting language such as JavaScript or Go.
- Project management experience for projects affecting multiple teams.
- Experience with Agile environments, customer focus, training or onboarding, and clear written and verbal English communication.
- Preferred security certifications include CISSP, CCSP, Certified Kubernetes Security Specialist, or GCP, AWS, or Azure security certifications.
- Curiosity and willingness to use and learn AI tools.
Benefits
- Comprehensive health benefits for employees and dependents, including OpenUp mental health support.
- Annual learning budget, self-paced learning platforms, language training, coaching, mentorship, and leadership programs.
- Additional fully paid parental leave through Family Leave Plus.
- Equity participation program.
- Hybrid work arrangement requiring three days per week in the Berlin, London, or Valencia office.
Categories