Staff Product Security Engineer

About the role

Altium 365, the cloud platform for electronics design, is looking for a Staff Product Security Engineer in Lisbon to strengthen its product security capability, with a strong focus on continuous vulnerability discovery and prevention. The role ensures that existing functionality and new changes stay secure over time, finding real vulnerabilities before customers do.

Key responsibilities

• Security regression testing: design and maintain test suites for critical flows, integrate them into CI/CD pipelines, and define coverage targets for authentication, access control, APIs and data flows
• Threat modeling: run sessions on existing components and new features, identify attack surfaces and abuse cases, and turn threats into test cases, security requirements and mitigation plans
• Offensive security: perform manual and automated testing simulating attackers, validate exploitability and business impact, and partner with engineering teams to reproduce issues, prioritize fixes and validate remediation
• Vulnerability discovery: continuously assess the platform against the OWASP Top 10, using deep product knowledge to find logic flaws beyond DAST/SAST tools
• Security assurance: review new features for security risks and act as a security gatekeeper while enabling teams with guidance and tooling
• Collaboration: work with engineering, architecture and SRE / platform teams, contribute to secure-by-design practices and help scale security through reusable patterns, automation and guidance

Required profile

• 5+ years in application / product security
• Bachelor's degree or equivalent of 12 years of work experience
• Hands-on experience in web application security testing, API security, threat modeling and OWASP Top 10
• Ability to identify business logic vulnerabilities
• Preferred: SaaS / multi-tenant experience, bug bounty programs, red teaming, security automation frameworks, AWS, identity systems (SSO, MFA), and a background in software engineering

Required skills

• Manual penetration testing and security regression testing
• CI/CD security integration
• Authentication, authorization and session management
• Multi-tenant architectures and cloud-native systems