Senior Product Security Engineer

As a Senior Product Security Engineer, you will be focused on developing S-SDLC activities and controls that will ensure our applications are designed and implemented with regards to the highest level of security standards.

About the Role:

As a Senior Product Security Engineer, you will play a crucial role in safeguarding our sensitive data, protecting our customers, and ensuring the resilience of our systems against evolving threats. You will:

• Lead the design, architecture, and implementation of secure products, encompassing all stages of the Secure Software Development Life Cycle (S-SDLC).
• Support engineering team including leading threat modeling sessions and conducting security reviews to guide secure design discussions.
• Take end-to-end ownership of security projects, including developing security tools, technology rollout, creating new security practices, and actively participating in risk assessments.
• Create and maintain security guidance, documentation and secure our paved roads.
• Champion a data-driven approach by contributing to security related data ingestion, security metrics, reporting, and potentially building PowerBI dashboards.
• Collaborate with the Security Awareness team to deliver engaging and targeted application security training to our engineers.
• Support our Software Supply Chain Security strategy.

About You:

You are a passionate and driven security professional who thrives in a collaborative environment. You are a team player who actively shares knowledge and supports colleagues. You possess:

• Engineer Empathy: A strong understanding of how developers work, enabling you to effectively present and advocate for security initiatives.
• Application Security Expertise: A deep understanding of application security principles, common type of vulnerabilities, secure design pattern, secure coding and DevSecOps practices through security tooling with SAST, SCA and DAST.
• Drive for Continual Improvement: The ability to analyze existing processes and identify opportunities for optimization and increased efficiency.
• Learning Mindset: A hunger for knowledge and a passion for staying ahead of emerging security trends and technologies.
• Strong Communication Skills: Excellent written and verbal communication skills, including the ability to effectively convey technical concepts to both technical and non-technical audiences.

Technical Skills:

• 5+ years of demonstrable experience in application security or a related field such as software engineering.
• Experience building and reviewing threat models, recommending secure design patterns, and conducting secure code reviews and risk assessments.
• Deep technical understanding of common security vulnerabilities, risks, exploitation techniques and their respective countermeasures and compensating controls.
• Proven ability to collaborate with product development teams to seamlessly integrate security into the development lifecycle.
• Expertise with SAST, SCA and DAST tools and a good understanding of their limitations, with the ability to discern true positives and guide developers accordingly.
• Proficiency in scripting and automation, utilizing APIs, with preferred languages/tools including Python.
• Experience building and securing CI/CD pipelines, preferably using GitHub Actions, with an "as-code" mindset.
• Familiarity with API security, vulnerability disclosure programs, and bug bounty practices.

Additional Experience (Beneficial):

• Experience with a major cloud provider (AWS, Azure, Oracle Cloud or GCP)
• Experience with Infrastructure as Code (e.g., Terraform).
• Experience with common authentication and authorization standards (SAML and OAuth).
• Knowledge of security frameworks such as OWASP ASVS, CIS Benchmarks, and NIST CSF/SSDF.
• Familiarity with OWASP SAMM or BSIMM.
• Agile methodology experience.
• Experience supporting security champions programs.
• Relevant security certifications (e.g., OSCP, OSWE) are a plus.
• Experience with open-source security projects or contributions to the security community.
• Experience in security research, presenting at conferences, or publishing articles.

What's in it For You?

You will join our inclusive culture of world-class talent, where we are committed to your personal and professional growth through:

Hybrid Work Model: We’ve adopted a flexible hybrid working environment (2-3 days a week in the office depending on the role) for our office-based roles while delivering a seamless experience that is digitally and physically connected

Wellbeing: Comprehensive benefit plans; flexible and supportive benefits for work-life balance: flexible vacation, two company-wide Mental Health Days Off; work from another location for up to a total of 8 weeks in a year, 4 of those weeks can be out of the country and the remaining in the country, Headspace app subscription; retirement, savings, tuition reimbursement, and employee incentive programs; resources for mental, physical, and financial wellbeing.

Culture: Globally recognized and award-winning reputation for equality, diversity and inclusion, flexibility, work-life balance, and more.

Learning & Development: LinkedIn Learning access; internal Talent Marketplace with opportunities to work on projects cross-company; Ten Thousand Coffees Thomson Reuters café networking.

Social Impact: Ten employee-driven Business Resource Groups; two paid volunteer days annually; Environmental, Social and Governance (ESG) initiatives for local and global impact.

Purpose Driven Work: We have a superpower that we’ve never talked about with as much pride as we should – we are one of the only companies on the planet that helps its customers pursue justice, truth and transparency. Together, with the professionals and institutions we serve, we help uphold the rule of law, turn the wheels of commerce, catch bad actors, report the facts, and provide trusted, unbiased information to people all over the world.

Do you want to be part of a team helping re-invent the way knowledge professionals work? How about a team that works every day to create a more transparent, just and inclusive future? At Thomson Reuters, we’ve been doing just that for almost 160 years. Our industry-leading products and services include highly specialized information-enabled software and tools for legal, tax, accounting and compliance professionals combined with the world’s most global news services – Reuters. We help these professionals do their jobs better, creating more time for them to focus on the things that matter most: advising, advocating, negotiating, governing and informing.

We are powered by the talents of 26,000 employees across more than 70 countries, where everyone has a chance to contribute and grow professionally in flexible work environments that celebrate diversity and inclusion. At a time when objectivity, accuracy, fairness and transparency are under attack, we consider it our duty to pursue them. Sound exciting? Join us and help shape the industries that move society forward.

Accessibility

As a global business, we rely on diversity of culture and thought to deliver on our goals. To ensure we can do that, we seek talented, qualified employees in all our operations around the world regardless of race, color, sex/gender, including pregnancy, gender identity and expression, national origin, religion, sexual orientation, disability, age, marital status, citizen status, veteran status, or any other protected classification under applicable law. Thomson Reuters is proud to be an Equal Employment Opportunity/Affirmative Action Employer providing a drug-free workplace.

We also make reasonable accommodations for qualified individuals with disabilities and for sincerely held religious beliefs in accordance with applicable law.

Protect yourself from fraudulent job postings click here to know more.

More information about Thomson Reuters can be found on https://thomsonreuters.com.