Senior Product Security Engineer

About the role

Airwallex, the AI-native financial operating system used by more than 675,000 businesses, is hiring a Senior Product Security Engineer. You will help protect its products, infrastructure, systems and data from evolving cybersecurity threats, working closely with Infrastructure, Product and Engineering teams to analyse applications, design and implement security controls and drive practical improvements. You will work from the San Francisco office three days a week.

Key responsibilities

• Partner with Infrastructure, Product and Engineering teams to strengthen the security of applications, software and services.
• Build and improve security controls, detection strategies and incident response workflows.
• Investigate cybersecurity incidents and hunt for threats across endpoint, network and cloud data.
• Design, deploy and maintain cybersecurity infrastructure projects supporting secure systems and defensive operations.
• Assess systems and networks for vulnerabilities, configuration deviations and policy gaps, then support mitigation and remediation.
• Collect, examine and preserve digital forensic evidence using analytical and investigative techniques.

Required profile

• 5+ years' experience in security engineering or incident response within a technology company.
• Experience analysing applications, software, services, systems and networks to identify vulnerabilities, configuration deviations and policy gaps.
• Experience designing, testing, implementing, deploying and maintaining cybersecurity infrastructure and controls.
• Experience with incident response, threat hunting, detection engineering, tactical forensic analysis or defensive operations.
• Strong communication skills, able to explain technical security concepts to a non-technical audience.
• Preferred: a bachelor's degree in Cybersecurity, Computer Science or a similar field; recognised cybersecurity training or certifications such as OSCP, GIAC or CEH.

Required skills

• Deep knowledge of software development tools and infrastructure, including CI/CD tooling and pipelines.
• Comprehensive understanding of common attacker tools and techniques, and how to detect, prevent and respond to incidents.
• Preferred: strong experience with Splunk and other security monitoring tools.
• Preferred: DevOps or SRE experience with Kubernetes, and experience with GCP or Alibaba Cloud.
• Preferred: experience with Okta, GSuite and cloud-based VPN services, and with Python, Java or Kotlin.