Product Security Engineer - L3 (Senior)

Design and implement pragmatic, efficient, and compliant security controls across our products, APIs, and cloud infrastructure as part of a primarily greenfield security program Lead security architecture reviews and threat modeling for new and existing systems, guiding engineering toward secure-by-design solutions Embed security into the SDLC secure code review, SAST/DAST, dependency and supply chain security, and secure design guidance Perform and coordinate penetration testing across web, API, mobile, cloud, and AI systems; prioritize risk and drive remediation to completion Secure our AI and LLM-powered features against threats such as prompt injection, data poisoning, model supply chain attacks, and sensitive data exposure Build tooling and workflows that use AI and agents to automate triage, detection engineering, secure code review, and compliance evidence collection Partner with engineering, product, and infrastructure teams to translate financial-sector and data privacy requirements into practical engineering controls Support incident response, forensics, and post-incident learning across product and cloud environments Contribute to security awareness and best practices across the company, acting as a trusted security partner to the business Map our current product, cloud, and AI attack surface and produce a prioritized risk picture with the Head of Security and engineering leadership Establish a lightweight but effective threat modeling and security review process for new features and architectures Run an initial penetration test (or coordinate an external one) against our highest-risk product and cloud surfaces, and drive remediation of critical findings Define and roll out baseline secure SDLC controls SAST, dependency scanning, secret scanning, and secure code review guidance Identify the first high-leverage opportunities to automate security workflows with AI and ship at least one working automation Produce an initial product security roadmap aligned with our business goals, regulatory obligations, and engineering velocity

Desired Candidate Profile

Significant hands-on experience in product, application, offensive, or cloud security roles Strong penetration testing background across web applications, APIs, and cloud environments Deep understanding of secure SDLC principles and modern DevSecOps tooling Proven experience in security architecture and threat modeling (e.g., STRIDE, PASTA, attack trees) Solid experience securing cloud infrastructure (AWS) IAM, networking, containers, Kubernetes, and infrastructure-as-code Working knowledge of AI security securing LLM-based applications, OWASP Top 10 for LLMs, prompt injection, and AI supply chain risks Practical experience using AI tools and agents to automate security workflows (triage, code review, detection engineering, compliance) Demonstrated ability to operate with ownership and autonomy in ambiguous, fast-moving environments you decide, you deliver, you own the outcome Ability to design efficient, pragmatic, and compliant controls in a greenfield context, balancing risk, speed, and engineering velocity Strong written and verbal communication skills; able to translate complex security topics for both technical and non-technical audiences Previous experience in fintech or other regulated financial services environments Familiarity with financial-sector security frameworks and regulations (e.g., PCI DSS, SOC 2, ISO 27001, NIST CSF, DORA, PSD2, FSRA, CBUAE) Working knowledge of data privacy regulations (GDPR, PDPL, and equivalents) Prior experience designing or building a security program from scratch (greenfield) Strong coding background (Python, Go, TypeScript) and comfort shipping production-quality tooling Relevant certifications (OSCP, OSCE, OSWE, CISSP, GPEN, CCSP, or equivalent) Knowledge of English or additional languages