The role is about:

We are looking for a Senior Product Security Engineer to build product security across our engineering organization. You will build the practice, not inherit it. Reporting to the Head of Information Security, you will embed security directly into the software development lifecycle — from architecture and design through build, deployment, and remediation. You will introduce security gates into engineering workflows, select and operate the right application security tooling, and use AI and automation to increase security coverage without slowing product delivery.

Location: Fully remote from Portugal or Poland
Reporting to: Head of Information Security

What you will do:

Design and introduce security gates into the development lifecycle, including embeded secure release practices and guardrails into the way software is built and deployed.
Lead threat modelling for new products and major changes
Provide secure-by-design input for new product builds across card issuing, embedded finance / banking-as-a-service, and other payment products
Define secure-by-default architecture patterns for the application layer — authentication, authorization, API design, service-to-service trust — so the secure path is the easiest path for engineering teams
Decide where traditional tooling is the right fit and where AI-assisted alternatives provide better coverage or efficiency
Own CI/CD pipeline and software supply-chain security controls across engineering teams
Implement and improve container image scanning, dependency management, software bill of materials, and security checks on infrastructure-as-code and deployment manifests
Build the practice AI-first - introduce AI agents and LLM-assisted workflows the default delivery mechanism for application security
Drive remediation of application-layer findings with engineering teams, including findings from penetration tests, scanners, and disclosure reports

What we need:

5+ years of experience in Product Security, Application Security in payments, fintech, banking, e-money, or another fintech product environment
Strong hands-on experience embedding security into the software development lifecycle
You read code comfortably and hold your own in design discussions with senior engineers
Proven experience with threat modelling, secure-by-design reviews, and working with engineers during architecture and delivery stages
Hands-on experience with application security tooling such as SAST, SCA, secrets detection, and DAST
Hands-on experience securing cloud-native applications on AWS or other major cloud
Strong AI proficiency and hands-on experience (agentic workflows and loops, RAG, MCP, etc)
Solid understanding of Cloud-first environment and modern development practices
Experience securing CI/CD pipelines and improving software supply-chain security
Ability to work directly with engineering teams and influence secure delivery in practice, not just through policy
Strong ownership mindset — able to define, implement, improve, and drive adoption of security practices across multiple teams
Strong written and verbal English

Nice to have:

Experience supporting new product launches in cloud-native or API-driven environments
Detection-as-code or security-as-code mindset
Penetration-testing or offensive-security background
Certifications such as CISSP, CSSLP, CCSP, OSCP, or similar

Hiring Process:

Step 1 – Thinking in Action (40 minutes) Your first conversation will be with our Talent Acquisition team. We'll explore your background, career journey, motivations, and overall fit for the role. As part of this discussion, you'll also complete a short te

…