Product Security Engineer — Cloud-Native

The role is about:
We are looking for a Senior Product Security Engineer to strengthen and scale product security across our engineering organisation.
Reporting to the Head of Information Security, you will embed security directly into the software development lifecycle — from architecture and design through build, deployment, and remediation — helping us launch secure products across card issuing, embedded finance / banking-as-a-service, and other payment solutions.
This is a hands‐on senior role with real ownership: you will introduce security gates into engineering workflows, select and operate the right application security tooling, improve CI/CD and software supply‐chain security, and use AI and automation to increase security coverage without slowing product delivery.
Location: Limassol, Cyprus
Reporting to: Head of Information Security
What you will do:Design and introduce security gates into the development lifecycle, including security requirements at design stage
Lead threat modelling for new products and major changes
Introduce security review practices into the pull‐request flow
Provide secure‐by‐design input for new product builds across card issuing, embedded finance / banking‐as‐a‐service, and other payment products
Select, deploy, and operate application security tooling across static analysis (SAST), software composition analysis (SCA), secrets detection, and dynamic testing (DAST)
Decide pragmatically where traditional tooling is the right fit and where AI‐assisted alternatives provide better coverage or efficiency
Build AI‐assisted secure code review and finding triage into the engineering workflow
Own CI/CD pipeline and software supply‐chain security controls across engineering teams
Implement and improve container image scanning, dependency management, software bill of materials, and security checks on infrastructure‐as‐code and deployment manifests
Help ensure secure release practices are embedded in the way software is built and deployed
Operate and maintain the group's Product Security Requirements as a living standard applied to real launches
Drive remediation of application‐layer findings with engineering teams, including findings from penetration tests, scanners, and disclosure reports
Define realistic SLAs, track remediation ageing, and provide honest reporting
Build product security awareness and capability across engineering through training, design reviews, and security champions initiatives
Apply AI and automation to day‐to‐day product security work, including code review support, finding triage, and workflow acceleration
Help extend security review coverage across multiple engineering teams without introducing unnecessary friction
What we need:5+ years of experience in Product Security, Application Security, Security Engineering, or a closely related software security role
Strong hands‐on experience embedding security into the software development lifecycle
Proven experience with threat modelling, secure‐by‐design reviews, and working with engineers during architecture and delivery stages
Hands‐on experience with application security tooling such as SAST, SCA, secrets detection, and DAST
Experience securing CI/CD pipelines and improving software supply‐chain security
Ability to work directly with engineering teams and influence secure delivery in practice, not just through policy
Strong ownership mindset — able to define, implement, improve, and drive adoption of security practices across multiple teams
Strong written and verbal English
Nice to have:Experience in payments, fintech, banking, e‐money, or another regulated product environment
Experience supporting new product launches in cloud‐native or API‐driven environments
Familiarity with container security, Kubernetes security, and infrastructure‐as‐code security
Experience with AI‐assisted security workflows or automation in AppSec / Product Security
Detection‐as‐code or security‐as‐code mindset
Certifications such as CISSP, CSSLP, CCSP, OSCP, or similar
Hiring Process:Step 1 – Thinking in Action (40 minutes) Your first conversation will be with our Talent Acquisition team.
We'll explore your background, career journey, motivations, and overall fit for the role.
As part of this discussion, you'll also complete a short technical screening that will be reviewed by our engineering team.
This stage helps us understand both your experience and how you approach technical challenges.
Step 2 – Hiring Manager interview (60-minutes) you will meet the hiring manager Head of Information Security, to explore your skills, achievements, and alignment with the role.
Step 3 – Final Interview (45 minutes) The final stage is a group interview with senior members of our Technology squad, which may include the CTO, CPO and Head of Security.
Together, we'll discuss team fit,