Product Security Engineer

We’ve signed up to an ambitious journey. Join us!

As Arrive, we guide customers and communities towards brighter futures and more livable cities, it isn’t a challenge just anyone could take on. Luckily, we have something to help us make it happen. Our people and our values. We Arrive Curious, Focused and Together. Just as our entire brand is inspired by the North Star, the shining light leading travelers to their destinations since time began, our values guide us. They help us be at our best. For our customers. For the cities and communities we serve. For ourselves. As a global team, we are transforming urban mobility. Let’s grow better, together.

We are seeking a Product Security Engineer to strengthen the security posture of our applications and cloud-native platforms. This role focuses on proactive application security testing, vulnerability management, secure SDLC integration, and collaboration with engineering teams. You will independently conduct security assessments across web applications, APIs, and cloud environments, while supporting secure development practices and contributing to improving overall product security maturity.

Key Responsibilities: Application & API Security

● Conduct manual and automated penetration testing of web applications and APIs.

● Identify and validate vulnerabilities aligned with OWASP Top 10 and API Security Top 10.

● Perform threat modeling for new features and services.

● Conduct secure code reviews (static analysis) and recommend remediation.

● Validate findings from SAST, DAST, and dependency scanning tools.

● Provide remediation guidance and conduct fix verification testing.

● Participate in design reviews and architecture discussions from a security perspective. Cloud & Infrastructure Security

● Assess AWS/Azure/GCP configurations for common misconfigurations.

● Review IAM policies, storage access controls, and container security posture.

● Validate findings from CSPM/CNAPP tools.

● Support cloud-native application security assessments. Vulnerability Management

● Prioritize vulnerabilities using CVSS and business impact context.

● Track remediation SLAs and support risk acceptance decisions.

● Provide actionable recommendations to development teams. Security Testing & Automation

● Develop scripts and tooling (Python/Bash) to automate testing workflows.

● Improve security testing playbooks and documentation.

● Contribute to enhancing detection and monitoring coverage. Collaboration & Reporting

● Prepare high-quality technical reports with clear risk articulation.