JobCubby JobCubby
Sign up
TRG TECH RESEARCH GROUP Limited

Product Security Engineer (Application and Cloud)

TRG TECH RESEARCH GROUP Limited Nicosia, Nicosia District, Cyprus

Blockchain Services · 2-10 employees

Yesterday
security Senior (5-10 yrs) Full-time Cyprus
Create a free account to apply — email only, no card. You can also save this posting or score it against your profile with AI.

Applying here? Try the free cover letter tool — paste this posting and your résumé, no account needed.

About the role

Secure the platform across application development and cloud infrastructure by operating security controls, threat-modeling features, testing authentication and tenant isolation, and hardening cloud and Kubernetes environments. Manage vulnerability detection and remediation, security monitoring, penetration testing, customer deployment baselines, and SOC 2 evidence.

What they look for

Application Security Cloud Security Python Angular TypeScript AWS Kubernetes Terraform MongoDB PostgreSQL Threat Modeling Multi-Tenant Authorization Vulnerability Management Security Information and Event Management Penetration Testing OWASP

Requirements

Requires at least five years of application or product security experience, prior software engineering experience, and the ability to work with Python backends and Angular/TypeScript frontends. Candidates should have hands-on AWS, Kubernetes, and infrastructure-as-code security experience, database access-control knowledge, and deep familiarity with OWASP risks and multi-tenant authorization.

Full description

Product Security Engineer (Application and Cloud)

This replaces the Application Security Engineer role and adds cloud infrastructure security. If you hire JD 4, its cloud outcomes move there and this role narrows to application security.

Reports to: Head of Security · Location: Nicosia, Cyprus · Works with: Engineering pillars, Foundations, DevOps

The role

You secure the TRG platform from the first commit to the running cluster. You embed security in how our engineers design, build and ship. You own and operate the platform's security controls with your own production access, without waiting on another team.

Outcomes you will own

  • Run SAST, dependency and secret scanning on every repository, blocking critical findings at merge.
  • Threat-model every new feature that touches tenant data, authentication or authorisation.
  • Prove tenant isolation across multi-tenant platforms, including fine-grained Need-to-Know authorisation.
  • Secure authentication flows: MFA, trusted devices, password reset, session handling.
  • Define and test controls for Intellectus AI agents: prompt injection, data leakage, tool misuse.
  • Maintain CIS benchmark hardening on cluster node images, Kubernetes, cloud accounts and edge services; alert on drift.
  • Run host, network and runtime detection across cloud nodes, feeding the SIEM; tune rules until every alert is actionable.
  • Change VPCs, subnets and security groups directly through infrastructure-as-code.
  • Scan nodes and containers continuously; patch critical CVEs within 48 hours.
  • Run the secret store; rotate secrets and scan code, images and logs for leaks.
  • Harden and monitor customer VPN servers.
  • Publish a hardening baseline and release checklist for dedicated and on-premises customer deployments.
  • Manage external penetration tests and bug reports; track every finding to a fix date.
  • Watch infostealer feeds for customer platform credentials; force resets and alert the account owner.
  • Supply SOC 2 evidence for change management, vulnerability management and logging.
  • Run DAST against every web application and API before each release.
  • Red-team our code: manual review and exploit testing of authentication, authorisation and tenant boundaries.

First 90 days

  • Inventory every internet-facing asset across all production regions and engineering infrastructure.
  • Review code, dependency and secret scanning coverage across all repositories; close the gaps.
  • Review detection coverage across every cloud node; ship the first ten tuned alerts.

What you bring

  • 5+ years in application or product security, with prior software engineering experience.
  • Reads and fixes Python backends and Angular/TypeScript frontends.
  • Hands-on with AWS and Kubernetes security: IAM, network policy, secrets, workload hardening; operates infrastructure through Terraform or equivalent.
  • Experience with MongoDB and PostgreSQL access control.
  • Deep knowledge of OWASP Top 10, OWASP API Top 10, and authorisation flaws in multi-tenant systems.
  • Prefers open-source tooling and automation over manual review.

Nice to have

  • Experience securing LLM applications (OWASP Top 10 for LLM Applications).
  • Open-source host, network and runtime detection tooling.
  • Delivered software into air-gapped or sovereign environments.
  • OSCP, OSWE or equivalent.

Similar roles