13 hours ago
London, United KingdomSenior
Responsibilities
- Own the product security roadmap and align security priorities with business goals and engineering leadership.
- Establish and manage the application security vulnerability management process, including triage, prioritization, remediation tracking, metrics, and reporting.
- Perform threat modeling and security reviews for web, mobile, and API services.
- Conduct code reviews and SAST/DAST assessments and manage third-party penetration tests through remediation.
- Strengthen the security of iOS and Android applications and their APIs, including authentication, authorization, secure data storage, API gateway controls, and abuse prevention.
- Implement, maintain, and automate vulnerability scanning and application security posture management tools.
- Train and mentor engineering teams on secure coding and deployment practices and help grow a security champions program.
- Align product security practices with relevant frameworks and standards and support compliance and audit activities.
Requirements
- Significant experience identifying, assessing, and mitigating security risks across application design, code, and deployed products.
- Experience establishing application security vulnerability management processes and reporting security metrics.
- Experience creating and delivering product or application security roadmaps and influencing engineering leaders.
- Experience securing and testing iOS and Android applications and APIs, including OAuth 2.0 and OpenID Connect.
- Hands-on experience with SAST, DAST, vulnerability scanning, mobile application security testing, and API security testing tools.
- Practical experience with threat modeling, security reviews, and managing third-party penetration tests.
- Strong knowledge of secure coding practices and embedding security controls and automation into CI/CD pipelines.
- Experience with cloud-native, containerized, and infrastructure-as-code environments.
- Familiarity with OWASP, the Mobile Application Security Verification Standard, API Security Top 10, PCI DSS, ISO 27001, and GDPR.
- Experience with security champions programs, risk assessments, or regulatory compliance is helpful.
Benefits
- Private healthcare and dental insurance.
- Generous work-from-abroad policy, including a 28-day Work from Abroad policy.
- 2-for-1 share purchase plans and an electric vehicle scheme.
- Extra festive time off and family-friendly benefits.
- Clear career paths, transparent pay bands, personal learning budgets, and regular learning days.
- Hybrid work model requiring at least 60% of office time over a 12-week period.
Tech Stack
AssemblyiOS
Categories
About Trainline
Trainline builds an online marketplace and software that let consumers and partners search, book, and manage rail and coach travel via its apps, website, and APIs. It aggregates schedules and fares from over 270 carriers across roughly 45 countries, supports e-ticketing, payments, and disruption information, and earns commissions and fees on ticket sales. Founded in 1997 and headquartered in London, it is a public company listed on the London Stock Exchange.