Principal Security Engineer

We are looking for a Principal Product Security Engineer to help shape how security is built into our ecommerce platform and engineering organisation. This is a senior individual contributor role where you will operate at the intersection of Product Security and Application Security. You will work directly with engineers, architects, and product teams to solve complex security problems, influence technical decisions, and make secure-by-design engineering the norm.

You will have significant autonomy and influence to define the technical direction of Product Security, establish practical security standards, and raise security capability across engineering. As we increase our use of AI, you will also help us adopt AI securely and use it creatively to improve security and engineering productivity.

• Define security principles, standards, patterns, and guardrails that enable engineers to build securely at pace.

• Provide hands on security expertise across APIs, microservices, cloud infrastructure, authentication, authorisation, and software supply chain security.

• Lead threat modelling and security architecture reviews for important products and technology initiatives.

• Partner with engineers, architects, and product teams to identify risks and develop pragmatic solutions.

• Evolve our approach to application security, vulnerability management, and security throughout the development lifecycle.

• Build or enable automation that improves security outcomes while reducing friction for engineering teams.

• Identify emerging security risks, including those introduced by AI, and drive appropriate mitigation.

• Help establish the principles and practices that allow teams to move quickly while managing risk effectively.

• Raise overall security capability across the engineering organisation by mentoring engineers and Security Champions.

• Develop meaningful Product Security metrics and use them to drive continuous improvement.

• Direct the technical direction of Product Security and influence how security is designed, built, and operated across our platform.

• Communicate potential security risks and their impact to engineering and senior stakeholders.

• Enable engineering teams to adopt AI securely and enhance productivity.

• Significant experience in Product Security, Application Security, or Security Engineering in a modern software engineering environment.

• Strong experience with security architecture, threat modelling, and turning security concerns into practical engineering solutions.

• Deep understanding of application and API security, secure development practices, and modern software architectures.

• Experience securing cloud native applications, distributed systems, and embedding security into engineering workflows and the software development lifecycle.

• Strong understanding of software supply chain security, dependency risk, and SBOMs.

• Proven ability to influence multiple engineering teams, define security standards, and communicate effectively with senior technical stakeholders.

• Experience with, or a strong interest in, AI security and using AI to improve security engineering.

• Experience with Infrastructure as Code security, Security Champions, or Bug Bounty programmes.

• Experience or formal qualifications in relevant security or cloud areas.