Product Security Engineer, Redgate Software
£60-75k
Database DevOps and management solutions for developers
Open for applications
Database DevOps and management solutions for developers
501-1000 employees
Open for applications
£60-75k
501-1000 employees
Company mission
To solve the complex challenges of database management and ensure security across the DevOps lifecycle.
Role
Who you are
- Hands-on product/application security experience supporting engineering teams in a modern SDLC (requirements, design review, secure coding guidance, release support)
- Strong knowledge of the OWASP Top 10 and practical mitigation patterns; familiarity with OWASP ASVS is a plus
- Experience implementing or improving SAST/DAST processes: tool selection/tuning, signal-to-noise reduction, and scalable remediation workflows
- Working understanding of cloud and container security fundamentals in an environment using AWS and Docker (and related CI/CD practices)
- Comfort working across a primarily C# ecosystem (with some Java/Python), including the ability to review code and explain security issues clearly to developers
- Ability to translate security risk into actionable engineering priorities—balancing risk, delivery timelines, and operational realities
- You’re pragmatic: you care about real risk reduction, not checkbox compliance or perfect theoretical security
- You communicate clearly and respectfully, able to influence without authority and build trust across multiple product teams
- You’re structured and evidence-driven: you document decisions, measure outcomes, and iterate based on what’s working
- You’re comfortable in ambiguity and can shape an approach when requirements, tooling, or ownership aren’t fully defined yet
What the job involves
- As a Product Security Engineer, you’ll embed security into the software development lifecycle across multiple product teams. You’ll help teams build, ship, and operate secure software by defining requirements, improving detection and prevention (SAST/DAST), assisting teams with application security governance, and running threat modelling
- Partner with engineering and product teams to define and operationalise security requirements across the SDLC (from design to release)
- Audit application code for weaknesses and vulnerabilities
- Own or co-own application security governance practices: secure-by-default standards, patterns, guardrails, and exceptions/risk acceptance
- Drive SAST/DAST adoption and quality: tool tuning, triage workflows, severity calibration, and “fix-forward” enablement
- Support adoption of threat modelling for new features, architectural changes, and high-risk services—turning findings into actionable engineering work
- Provide product security guidance for cloud-native environments (AWS + containerised workloads), with an emphasis on secure service design and deployment practices
- Build strong relationships with product teams through clear communication, coaching, and security enablement
- Review and assist in the development of engineering policies aligned with security best practices
- Contribute secure shared libraries/paved-road components or perform targeted security testing/pentesting to validate controls
- Work with product teams to support implementation of AI, including LLMs, SLMs, and MCP
- 30 Days
- Onboard into Redgate’s products, SDLC, and delivery rhythms (how work moves from idea → code → deploy)
- Get access to core systems and security tooling; understand what’s in place today (SAST/DAST coverage, alert volumes, current processes)
- Shadow the Product Security Architect and sit in on a handful of ceremonies (planning/refinement/retro) to understand team dynamics and where security naturally fits
- Triage a small set of findings with guidance (e.g., top recurring SAST issues), focusing on learning severity expectations and remediation patterns
- Start building a knowledge base: common app patterns, approved controls, “how we do security here,” and where to find the right people
- 60 Days
- Begin owning a defined slice of AppSec work with supervision (e.g., one product area or a specific SDLC initiative like SAST tuning or DAST onboarding)
- Build working relationships with a small set of partner teams and establish a predictable engagement model (intake path, review checklist)
- Start contributing to security reviews for new features or higher-risk changes—initially as a second set of eyes, then independently for scoped areas
- Help improve signal-to-noise in SAST/DAST: tune rules, reduce duplicates, and document triage guidance that developers can follow
- Support lightweight threat modelling sessions alongside the Architect (prep, note-taking, translating outcomes into engineering actions)
- 90 Days
- Independently handle routine AppSec support for agreed scope (e.g., first-pass triage, basic secure design guidance, follow-ups with teams), escalating appropriately
- Deliver tangible process improvements that reduce friction (e.g., clearer severity rubric, a repeatable intake template, a “common findings” fix guide)
- Demonstrate steady throughput on findings: consistent triage quality, meaningful developer support, and reduced turnaround time for the scoped area
- Contribute to a secure-by-default library/SDK
- Tech / tool stack
- C# / .NET (primary engineering ecosystem), React
- Java (J2EE), TypeScript, and Python
- AWS (cloud infrastructure and services), Docker (containerised workloads)
- SAST/DAST tooling (specific products may vary; you’ll help tune and operationalise them)
Our take
As businesses become increasingly dependent on data, managing databases has become more complex. Companies need to move quickly while keeping systems secure and reliable. However, many still depend on manual processes and disconnected teams, making it harder to manage modern data infrastructure, especially as AI and cloud technologies continue to grow.
Redgate is helping companies tackle these challenges through database DevOps and lifecycle management tools. Its platform helps teams automate database changes, improve collaboration, and manage systems more efficiently and securely. Redgate, then, supports organisations throughout the full database development and deployment process.
More than 200,000 data professionals worldwide use Redgate's solutions too, signifying just how strong a position it has in the market. And with recent backing from Bregal Sagemount, the company plans to accelerate product innovation and expand even further so it can keep up with the ever-growing demand for secure, scalable data management.
Kirsty
Company Specialist at Welcome to the Jungle
Insights
Company
Company values
- We're reasonable: We treat everyone as we would want to be treated ourselves, even when the circumstances are difficult.
- We're ingeniously simple: Our best products and services are ingeniously simple. The same goes for how we work internally. We work best when we don't overcomplicate things.
- Transparency helps us continually improve: We make mistakes visible and share the evidence used to make decisions. No gossiping, no intrigue, no pussy-footing around problems.
- We do our best work in teams: We continually improve when we make the most of everyone's expertise. The company is more important than the team and the team is more important than the individual.
- When our customers succeed, so do we: At Redgate, your growth matters. You’ll have the freedom to develop the skills you want, in the way that works best for you—supported by guidance, resources, and encouragement every step of the way. Above are just a few of the ways we help people learn, grow, and thrive here.
- Don't be an asshole: No matter how smart you are, or how good you are at narrowly-defined tasks, there is no room for you here if you're an asshole.
Company HQ
Cambridge, UK
Leadership
Jakub Lamik
(CEO)Jakub joined Redgate in 2019 as CPO, moving into the role of CEO in 2021. Previously, they spent nearly 9 years at Arm in various roles, including VP of Product.
Kate Duggan
(CMO)Kate joined Redgate in 2015 as a Product Marketing Manager, since then, they have held a number of roles and became the CMO in 2021. Previously, they spent over 3 years at enLight as a Business Development Director.
Cassi Roper
(CRO)Cassie joined Redgate in 2006 working in Renewal Sales, since then, they have held a number of roles and became the CRO in 2023.
Steven Mitchell
(CFO)Prior to joining Redgate in 2022, Steven was the CFO at Six Degrees Group and Dreamland Margate. They also spent 4 years at eir Ireland as a Corporate Finance Director, Interim Group CFO and Chief Strategy Officer.
David Gummer
(CPO)Prior to joining Redgate in 2022, David was the Global Head of Service Strategy & Portfolio Management at Finastra, a Director of Product Management at NGA Human Resources and a Director of Product Management & Alliances at Lumesse. They also spent 8 years at BT as the Head of Corporate Development, GM - Online (BT Directories) and Telemetry/M2M (BT Redcare).
Graham McMillan
(CTO)Prior to joining Redgate in 2024, Graham spent 9 years at Elsevier as an Integration & Data Architect, Director of Software Engineering, and VP of Engineering. Prior to that, they spent 7 years at Oracle as an Enterprise Architect Senior Director.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 7 more jobs at Redgate Software