Staff Product Security Engineer at Renesas Electronics

Cambridge, England, United Kingdom -

Full Time

Start Date

Immediate

Expiry Date

02 Oct, 26

Salary

0.0

Posted On

04 Jul, 26

Experience

5 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Web Application Security Testing, API Security, Threat Modeling, OWASP Top 10, Manual Penetration Testing, Security Regression Testing, CI/CD Security Integration, Business Logic Vulnerability Identification, Authentication and Authorization, Multi-tenant Architectures, Cloud-native Systems, Red Teaming, Security Automation, AWS Identity Systems, Software Engineering

Industry

Semiconductor Manufacturing

Description

Job Description Why A365 Software Engineering? Build the cloud platform that’s transforming electronics design. Altium 365 for cloud lets design engineers communicate, collaborate and bring their ideas to market more efficiently than any platform in the industry. We are looking for a Senior Product Security Engineer to extend our Product Security capability with a strong focus on continuous vulnerability discovery and prevention. This role is responsible for: Building and executing security regression testing Driving threat modeling across existing and new functionality Conducting targeted offensive security activities (Red Team–style testing) Identifying real vulnerabilities based on a deep understanding of our platform and the OWASP Top 10 Web Application Security Risks The goal is simple: ensure that both existing functionality and new changes remain secure over time, and that real vulnerabilities are discovered before customers do. Key Responsibilities Security Regression Testing Design and maintain security regression test suites covering critical application flows Ensure vulnerabilities, once fixed, are permanently prevented from recurring Integrate security regression into CI/CD pipelines Define coverage targets for security-critical areas (auth, access control, APIs, data flows) Threat Modeling Lead structured threat modeling sessions for: Existing system components New features and architectural changes Identify attack surfaces, abuse cases, and trust boundaries Translate threats into: Test cases Security requirements Mitigation plans Ensure threat modeling becomes a continuous lifecycle activity Offensive Security / Red Team Activities Perform manual and automated security testing simulating real attacker behavior Focus on high-impact vulnerabilities, not theoretical findings Validate exploitability and business impact Partner with engineering teams to: Reproduce issues Prioritize fixes Validate remediation OWASP Top 10–Driven Vulnerability Discovery Continuously assess the platform against OWASP Top 10 categories Use deep product knowledge to find non-obvious, context-specific vulnerabilities Go beyond tooling (DAST/SAST) to uncover logic flaws and abuse paths Security Assurance for Product Changes Review new features and changes for security risks Ensure all changes are: Threat-modeled Covered by regression tests Act as a security gatekeeper without becoming a bottleneck: Enable teams with guidance and tooling Avoid heavy process overhead Collaboration & Enablement Work closely with: Engineering teams Architecture SRE / Platform teams Contribute to secure-by-design practices Support developers in understanding and fixing vulnerabilities Help scale security through: Reusable patterns Automation Security guidance Qualifications Required Qualifications 5+ years in Application / Product Security Bachelor's Degree or equivalent of 12 years of work experience Strong hands-on experience in: Web application security testing API security Threat modeling methodologies Deep understanding of OWASP Top 10 Experience with: Manual penetration testing Security regression testing CI/CD security integration Ability to identify business logic vulnerabilities Strong understanding of: Authentication, authorization, and session management Multi-tenant architectures Cloud-native systems Preferred Qualifications Experience in SaaS / multi-tenant platforms Familiarity with: Bug bounty programs Red teaming Security automation frameworks Knowledge of: AWS Identity systems and federation (SSO, MFA) Background in software engineering (ability to read/write code) Employment Type: Regular (PERM) Remote Work Available: No

Responsibilities

The role focuses on continuous vulnerability discovery and prevention through security regression testing and threat modeling. It involves conducting offensive security activities and ensuring new product changes remain secure against OWASP Top 10 risks.