Senior Product Security Consultant (Full‑Time)

About the role

We are seeking a senior‑level Product Security Consultant to lead and implement security initiatives for a variety of client products. The role bridges application security, DevSecOps, cloud security and consulting, working directly with development, DevOps and executive teams.

Key responsibilities

• Design, build and implement Secure Software Development Lifecycle (SSDLC) processes across organisations.
• Conduct threat modelling, architecture reviews and security design reviews.
• Collaborate with development and DevOps teams to design and deploy secure solutions.
• Assess security of web applications, APIs, gateways, backend services and communication protocols.
• Implement and improve SAST, SCA, DAST, secrets scanning and IaC scanning within CI/CD pipelines.
• Define security gates, branch protection and vulnerability remediation workflows.
• Analyse penetration‑testing reports, prioritise findings and drive remediation.
• Lead vulnerability management and continuous exposure management processes.
• Support security of cloud environments, containers and Kubernetes.
• Work with Cloudflare solutions (WAF, DNS, DDoS protection, Zero Trust).
• Translate SOC 2 and other compliance requirements into technical controls.
• Participate in security incident response, including investigation and remediation.
• Develop security standards, guidelines and documentation for development and infrastructure teams.

Required profile

• 4+ years of experience in product security, application security or DevSecOps.
• Hands‑on experience building or implementing SSDLC processes.
• Proven experience conducting threat modelling and architecture reviews.
• Strong knowledge of web and API security, authentication/authorization mechanisms and OWASP principles.
• Ability to read, understand and write code or scripts.
• Experience with at least one major cloud platform (AWS, Azure or GCP).
• Strong communication skills and ability to work independently with multiple stakeholders.

Required skills

• Secure Software Development Lifecycle (SSDLC)
• Threat Modelling
• Architecture Review
• Web Application & API Security
• OWASP standards
• CI/CD pipeline integration
• SAST, SCA, DAST, Secrets Scanning, IaC Scanning
• Linux environments
• AWS, Azure, or GCP
• Cloudflare WAF/DNS/DDoS/Zero Trust
• SOC 2 compliance
• Vulnerability Management
• Penetration Testing analysis
• Incident Response
• Kubernetes and container security