Staff Product Security Engineer

UpGuardHobartHybridFull-time10 Sept 2026

UpGuard is hiring its first dedicated Staff Product Security Engineer to define and scale product security across its cloud-native platform. The role involves threat modelling, security reviews, vulnerability management, detection and response, and embedding security into CI/CD and infrastructure-as-code. Requires 7+ years of security/software engineering experience with strong cloud, Kubernetes, and IAM security expertise.

What you'll do

Lead threat modelling and security reviews across UpGuard's product portfolio and cloud infrastructure, proactively surfacing attack vectors and designing mitigation strategies that scale with growth.
Build automation, policy-as-code, and AI-driven security tooling that lets product engineering teams 'shift left' and embeds security across the SDLC, leveraging agentic workflows to triage, review, and scale the reach of a lean security function.
Design and implement secure-by-default configurations for cloud and Kubernetes infrastructure.
Own vulnerability management end-to-end, triaging and prioritizing by real risk, driving remediation with engineering teams, and building preventative controls across the software supply chain from development through production.
Build scalable detection and response systems that catch malicious activity, triage the noise, and run incidents end to end.
Build deep partnerships with our product engineering and platform teams, helping them deliver secure-by-design solutions.
Refresh threat modelling and security review as a standard part of how we ship.
Figure out where AI actually helps in AppSec (code review, triage, coverage) and build what works.
Harden our GCP and Kubernetes baseline and get secure-by-default configs into infrastructure-as-code.

What you need

Must-have

Cloud securityGCPAWSAzureKubernetesEKSGKEAKS

Nice-to-have

AI/LLM security risksOWASP LLM Top 10GoSOC 2ISO 27001Offensive securityPublic security researchCVEs

Soft skills

CollaborationIterationSpeedNo-ego approachPragmatic trade-offsPartnership buildingAutonomyInfluence

Product SecurityCloud SecurityKubernetesGCPThreat ModellingVulnerability ManagementAppSecAI SecurityStaff EngineerIT Services

/What you'll do

/What you need

Must-have

Nice-to-have

Soft skills

What you'll do

What you need