Product Security Engineer

Responsibilities

• Being an advocate of security for product owners and engineers, with whom you'll build a working relationship.
• Performing web, mobile, and backend security assessments directly.
• Orchestrating web, mobile, and backend security assessments between our product teams and third‑party assessors when the situation calls for it.
• Weighing in on technical architecture discussions, ensuring security is considered from the very inception of new features.
• Threat modelling upcoming features, providing a more technical and hands‑on steer when necessary to illustrate security concerns with proposed feature implementations.
• Overseeing secure engineering training programmes, keeping our engineers aware of secure engineering practices, and abreast of the common security pitfalls to avoid.
• Integrating security tooling, stitching together CI steps, scripts, and small tools to automate security controls and visualise their results in a helpful manner. This could include SAST, SCA, DAST, secrets scanning, vulnerability scanning, or other tooling.
• Being guardians of our Secure Development Lifecycle, ensuring security controls are baked in and “pushed left” as much as reasonably possible.
• Triaging incoming reports and findings from bug bounties, automated tools, and more.
• Being comfortable doing “Just‑in‑Time” learning around technologies and frameworks as required to understand emerging technologies in the company, and the security concerns they raise – with appropriate time allocated by the company, of course.
• Advising engineers on security patching, and ensuring our team does as we say by keeping our own tools patched too.
• Staying cognizant of the balance required between security and productivity, and how to manage stakeholder's concerns around such trade‑offs.

• You have experience in offensive security, such as performing security assessments via tools like Burp Suite, nmap, Kali Linux, etc.
• Strong experience in at least web or a mobile OS, with a willingness to learn the other too.
• Fundamental networking and OS knowledge – you should know how to debug a failing DNS connection, be comfortable with command line tools, and broader computing principles.
• Comfortable threat modelling, assessing the balance between features and security. Being able to explain the trade‑offs to less technical stakeholders.
• Basic scripting knowledge – we have some in‑house tools we maintain ourselves.
• A willingness to learn basic software engineering principles to ensure said tools stay maintainable. Being confident in at least one language such as Python, JavaScript, or Go.
• Secure coding practices – being able to not just spot a SQL injection but provide detailed guidance about how to fix it and prevent it for future queries.
• Providing security advice during architectural design phases of new products. Spotting fundamental security flaws in designs early on, before code is even written.
• Basic cloud infrastructure knowledge, such as understanding the fundamentals of cloud compute instances (VMs), software‑defined networks, and defining infrastructure in code. Having experience in fintech, especially banks with mobile apps.
• Able to read common tech stack languages not commonly used in Info Sec, e.g. Java and C#. This can assist whitebox assessments.
• On top of knowing security skills, knowing fundamental software engineering practices to ensure modifications to our internal tools stay maintainable.

Subject to having the right to work in the country of choice.

Zopa is proud to offer a workplace free from discrimination. Diversity of experience, perspectives, and backgrounds leads to better products for our customers and a unique company culture for our people. We are made up of nearly 50 nationalities, have a DE&I forum made up of Zopians wanting to make a difference, and we are proud of our culture where everyone can bring their full self to work.

Our approach to DE&I is reflected in our hiring process so please let us know if you require any reasonable adjustments.