Senior Product Security Engineer
The Role
We build and operate a regulated digital health platform. Patients trust us with clinical data, identity documents and payment details, and our clinicians trust our systems to be correct. That makes application security a patient safety concern, not just a compliance one.
We are shipping quickly, adopting AI and agentic systems across clinical operations and patient-facing products, and running a lean security function that scales through engineering leverage rather than headcount. We need a senior engineer who can go deep on design and code, then bring the rest of the business along with them.
This is a hands-on individual contributor role with genuine influence over how the platform is built.
The Team
You will work within the Cyber Security function, collaborating directly with Engineering, Product, Clinical, Legal, and the executive team. Security at Numan is not a gatekeeping function - it scales through influence, credibility, and being useful early.
You'll be:
Running threat modelling sessions with product and engineering teams on new features and architectural changes - STRIDE-based, with clinical safety, abuse, and business-logic threats kept in mind alongside the technical ones.
Owning and evolving our Secure by Design process: self-evaluation screening, secure design review, and the threat modelling pathway, including our use of automated tooling against technical artefacts.
Turning threat models into tracked, prioritised controls that engineering teams actually implement.
Pushing design decisions upstream so the cheap fix is designed in rather than the expensive one retrofitted.
Assessing and securing AI systems in production: LLM-backed features, retrieval pipelines, agentic workflows, tool-calling integrations, and the MCP and API surfaces that connect them.
Building practical threat models and controls for agent-specific failure modes - prompt injection, tool misuse, excessive agency, data exfiltration through context, unsafe autonomy, and supply chain risk in model and plugin ecosystems.
Performing automated application and API penetration testing against our own products - web, mobile backends, cloud-native services on GCP, internal tooling, and AI features.
Leading penetration engagements with third parties and working on the fix with engineering.
Chaining findings into realistic attack paths and demonstrating impact, rather than delivering a list of scanner output.
Embedding security into our pipelines: SAST, SCA, secrets detection, IaC scanning, container and dependency hygiene - tuned so signal beats noise and engineers trust the gates.
Working with platform and engineering to raise baseline standards: authentication and authorisation patterns, secrets management, tenancy isolation, and logging and detection coverage.
Actively participating in the security community - OWASP chapters or projects, local meetups, CTFs, research groups - and publishing research, write-ups, or blog posts under your own name.
We're looking for someone who:
Brings substantial hands-on application security experience in a product engineering environment, at senior level.
Has demonstrable threat modelling practice - not just familiarity with the theory.
Has practical offensive skills against modern web and API stacks, with an appropriate certification or equivalent demonstrable experience (OSCP, OSWE, CREST, Burp Suite Certified Practitioner or similar).
Is comfortable reading and reasoning about code in at least one language used in production systems, and can review a pull request meaningfully.
Has working knowledge of cloud-native architecture and its security model - ideally GCP, but AWS or Azure experience transfers.
Has experience integrating security tooling into CI/CD, and the scars to know what makes engineers ignore it.
Has a track record of shipping security improvements through other teams.
Has experience securing AI or agentic systems in production.
- Has hands-on experience securing Kubernetes environments and managing cloud security posture using CNAPP and CSPM solutions, with a primary focus on GCP but AWS and Azure experience is translatable.
It’s a bonus if you have:
Regulated environment experience - healthcare, fintech, or similar - and comfort with frameworks such as ISO 27001 without treating compliance as the goal.
Detection engineering or incident response exposure for incidents related to application attacks.
An existing community footprint: talks, published research, maintained projects.