Senior Product Security Engineer, Numan

• Brings substantial hands-on application security experience in a product engineering environment, at senior level
• Has demonstrable threat modelling practice — not just familiarity with the theory
• Has practical offensive skills against modern web and API stacks, with an appropriate certification or equivalent demonstrable experience (OSCP, OSWE, CREST, Burp Suite Certified Practitioner or similar)
• Is comfortable reading and reasoning about code in at least one language used in production systems, and can review a pull request meaningfully
• Has working knowledge of cloud-native architecture and its security model — ideally GCP, but AWS or Azure experience transfers
• Has experience integrating security tooling into CI/CD, and the scars to know what makes engineers ignore it
• Has a track record of shipping security improvements through other teams
• Has experience securing AI or agentic systems in production
• Has hands-on experience securing Kubernetes environments and managing cloud security posture using CNAPP and CSPM solutions, with a primary focus on GCP but AWS and Azure experience is translatable

Desirable

• We build and operate a regulated digital health platform
• Patients trust us with clinical data, identity documents and payment details, and our clinicians trust our systems to be correct
• That makes application security a patient safety concern, not just a compliance one
• We are shipping quickly, adopting AI and agentic systems across clinical operations and patient-facing products, and running a lean security function that scales through engineering leverage rather than headcount
• We need a senior engineer who can go deep on design and code, then bring the rest of the business along with them
• This is a hands-on individual contributor role with genuine influence over how the platform is built
• You will work within the Cyber Security function, collaborating directly with Engineering, Product, Clinical, Legal, and the executive team
• Security at Numan is not a gatekeeping function — it scales through influence, credibility, and being useful early
• Running threat modelling sessions with product and engineering teams on new features and architectural changes — STRIDE-based, with clinical safety, abuse, and business-logic threats kept in mind alongside the technical ones
• Owning and evolving our Secure by Design process: self-evaluation screening, secure design review, and the threat modelling pathway, including our use of automated tooling against technical artefacts
• Turning threat models into tracked, prioritised controls that engineering teams actually implement
• Pushing design decisions upstream so the cheap fix is designed in rather than the expensive one retrofitted
• Assessing and securing AI systems in production: LLM-backed features, retrieval pipelines, agentic workflows, tool-calling integrations, and the MCP and API surfaces that connect them
• Building practical threat models and controls for agent-specific failure modes — prompt injection, tool misuse, excessive agency, data exfiltration through context, unsafe autonomy, and supply chain risk in model and plugin ecosystems
• Performing automated application and API penetration testing against our own products — web, mobile backends, cloud-native services on GCP, internal tooling, and AI features
• Leading penetration engagements with third parties and working on the fix with engineering
• Chaining findings into realistic attack paths and demonstrating impact, rather than delivering a list of scanner output
• Embedding security into our pipelines: SAST, SCA, secrets detection, IaC scanning, container and dependency hygiene — tuned so signal beats noise and engineers trust the gates
• Working with platform and engineering to raise baseline standards: authentication and authorisation patterns, secrets management, tenancy isolation, and logging and detection coverage
• Actively participating in the security community — OWASP chapters or projects, local meetups, CTFs, research groups — and publishing research, write-ups, or blog posts under your own name