Product Security Engineer

SRT Marine Systems plc (SRT) are a market leader in its domain of international marine surveillance technology and systems. We are respected, established and an ambitious multi-national company headquartered in the UK with a global customer base.

The company has a global impact in the marine domain by leading the next generation of Maritime Domain Awareness 'MDA' technologies, products and systems that significantly enhance, security, safety and environment protection and sustainability. Our customers are worldwide and range from the largest national coast guards to individual vessel owners.

SRT is an exciting company where high-quality results are rewarded. We are ambitious and are constantly seeking to innovate to deliver better products and services to our customers. We strive to make SRT a rewarding and challenging place to work where talented hard-working individuals have the opportunity to make a real impact across the marine world.

We are looking for a Product Security Engineer to help ensure security is properly built into our products from the ground up - in the designs we choose, the code we write, and the way our software is developed, tested and delivered.

This is a hands-on role embedded within our product development teams. You as a Product Security Engineer will work day-to-day with software developers, testers and product owners to improve the security of what we build and how we build it, and to make sure security has a clear voice when product priorities are set.

The role is a dedicated security role focused on the security of how we develop our products. It combines technical depth - reviewing designs and code, threat modelling, assessing risk pragmatically - with the credibility and communication skills to bring experienced developers along. It offers a genuine opportunity to grow into the leadership of our product security capability, and we welcome ambitious candidates ready to step up into a security specialism from a strong software engineering background.

The role of Product Security Engineer is primarily based from our Bristol office, but you must be willing to travel to our offices in Cardiff and Bath on occasion, with good flexibility for Hybrid working.

Responsibilities - Product Security Engineer - not exhaustive:
 
Champion security within our product development teams, providing a clear day-to-day voice for security in design, code and backlog decisions.
Embed secure development practices across the software development lifecycle, including secure coding standards, code review, testing, CI/CD and related controls.
Carry out threat modelling, secure design reviews and technical risk assessments for new and existing product capabilities, so that security is designed in from the start.
Assign pragmatic risk levels and support sensible prioritisation of remediation alongside feature delivery and other technical work.
Support vulnerability remediation, including root cause analysis and long-term fixes.
Track the security of third-party components and dependencies within our products, and lead our response when new vulnerabilities and supply-chain incidents emerge.
Ensure security features and fixes are properly represented in product roadmap, backlog and design decisions, working with product owners and engineering leadership.
Work with our external security partners to arrange and act on penetration testing and security assessments of our products.
Contribute to security standards, metrics and ways of working that improve product security maturity over time.
Support wider assurance and certification activity, including ISO 27001 or other relevant standards, with evidence of how our software is securely built.  

Requirements - Product Security Engineer - not exhaustive:
 
A strong software engineering background, with the technical depth to read code, review designs and engage credibly with experienced developers.

Experience of , or a strong demonstrable specialism in, application security or secure software engineering in a software-led environment.
Practical experience applying security across the software development lifecycle, including areas such as threat modelling,…