Product Security Expert
Employer · Cavendish Professionals
Security guardFlexibleFull-timeBudapest
We are looking for an experienced Product Security Expert to join our client, an in-house technology consultancy of a global consulting firm, driving best-in-class security engineering and securing large-scale cloud-native ecosystems. In this role, you will take technical ownership of end-to-end software security, lead architectural threat modeling, integrate automated security gates into CI/CD pipelines, and collaborate with security teams to implement cutting-edge frontier AI scanning capabilities.
Tasks
- Taking technical ownership of security and risk assessments across enterprise applications and distributed systems to uncover vulnerabilities early.
- Collaborating with security engineering teams to establish Frontier AI scanning capabilities, analyze complex findings, manage triage backlogs, and systematically eliminate false positives.
- Embedding advanced security controls directly into CI/CD pipelines, covering SAST, DAST, dependency analysis, and compliance-as-code.
- Moderating and co-leading threat modeling and risk assessment workshops using STRIDE to evaluate architectural and operational risks.
- Overseeing and resolving Jira security backlogs, risk exceptions, and remediation tracking across cross-functional teams.
- Developing, operationalizing, and maintaining security policies, standards, and SDLC procedures aligned with ISO 27001, SOC 2, and PCI-DSS compliance frameworks.
Requirements
- Proven commercial track record across software security, DevSecOps, or application security engineering within complex environments.
- Hands-on expertise with industry-standard security tools and vulnerability scanners (e.g., SAST/DAST tools, Tenable/Nessus, Rapid7, Aquasec/Trivy, Checkmarx, Fortify, Coverity, Black Duck).
- Experience managing enterprise SIEM and observability platforms (Splunk, Elastic).
- Deep knowledge of cloud-native architectures, container security, and Kubernetes orchestration.
- Practical software engineering background in Python, Go (Golang), and/or JavaScript.
- Consultant mindset: ability to translate technical security findings into actionable remediation roadmaps and communicate clearly with engineering leads and executive stakeholder.
- Solid background in Secure SDLC design, DevSecOps integration, and threat modeling frameworks (STRIDE).
- Deep hands-on experience with major cloud platforms (AWS, Azure, GCP) or OpenStack infrastructure.
- Strong command of regulatory and compliance standards (ISO 27001, SOC 2, PCI-DSS).
- Excellent English communication skills for daily international collaboration.