Product Security Engineer

Arm is looking for a Product Security Engineer to join our Product Security Incident Response Team. This role will support the handling, coordination, and disclosure of security vulnerabilities affecting Arm products and technologies.

You will work closely with engineering, architecture, legal, communications, customer-fac­ing teams, researchers, partners, and industry bodies to assess reported vulnerabilities, coordinate remediation activity, and support responsible disclosure.

• Drive the triage, assessment, and resolution of product security vulnerabilities across Arm hardware and software.
• Lead and coordinate product security incident response
  , working across engineering teams, business functions, customers, and industry partners.
• Own coordinated vulnerability disclosure activities
  , including disclosure strategy, timelines, customer communications, CVE assignment, and security advisory publication.
• Represent Arm in security engagements with researchers, customers, partners, and the wider security community.
• Support and evolve Arm's bug bounty programs
  , ensuring high-quality vulnerability assessment, researcher engagement, and effective internal coordination.
• Strengthen Arm's product security capability through continuous improvement of PSIRT processes, tooling, metrics, and incident response practices.
• Safeguard the integrity and confidentiality of vulnerability handling
  , ensuring responses are accurate, timely, and aligned with industry best practice.

• Previous experience working in a PSIRT, vulnerability disclosure, or bug bounty triage role.
• Working knowledge of CVE processes, vulnerability advisories, severity assessment, and remediation coordination.
• Ability to communicate clearly with both technical and non-technical collaborators, working across different teams and priorities in time-sensitive situations.

• Experience with hardware and/or software vulnerability handling.
• Experience working with or supporting a bug bounty program.
• Familiarity with performing vulnerability severity scoring such as CVSS.
• Understanding of secure development practices, product security risk management, or security architecture.
• Experience engaging with external researchers, customers, CERTs, CVE/CNA programs, or industry security communities.

You are pragmatic, collaborative, and calm under pressure. You understand the importance of trust, confidentiality, and clear communication in vulnerability handling. You can balance technical accuracy with practical coordination, and you are motivated by helping teams respond effectively to product security issues.

You are excited by the opportunity to help secure the technologies shaping the future of AI and computing at Arm - a world-leading organisation whose technology powers billions of devices, from tiny microcontrollers and everyday smartphones to the systems at the heart of advanced data centres. You want to work alongside exceptional engineers and researchers, deepen your expertise through technically challenging work, and see your contribution strengthen security across a global technology ecosystem.

At Arm, we believe progress happens when people are empowered to think bigger and push beyond what seems possible. Our 10x mindset is about curiosity, ambition and creating impact that will be used by millions. We learn fast, prioritise collaboration and turn bold ideas into real technology. We look for people who are inspired by this way of working and want to grow in an environment where bold ideas are welcomed.

Discover how the 10x mindset shapes life at Arm:

At Arm, we embrace the benefits AI can bring, including in recruitment. You may use AI to support…