Product Security Engineer (Application and Cloud) at TRG · Nicosia

Product Security Engineer (Application and Cloud)

This replaces the Application Security Engineer role and adds cloud infrastructure security. If you hire JD 4, its cloud outcomes move there and this role narrows to application security.

Reports to: Head of Security · Location: Nicosia, Cyprus · Works with: Engineering pillars, Foundations, DevOps

The role

You secure the TRG platform from the first commit to the running cluster. You embed security in how our engineers design, build and ship. You own and operate the platform's security controls with your own production access, without waiting on another team.

Outcomes you will own

• Run SAST, dependency and secret scanning on every repository, blocking critical findings at merge.
• Threat-model every new feature that touches tenant data, authentication or authorisation.
• Prove tenant isolation across multi-tenant platforms, including fine-grained Need-to-Know authorisation.
• Secure authentication flows: MFA, trusted devices, password reset, session handling.
• Define and test controls for Intellectus AI agents: prompt injection, data leakage, tool misuse.
• Maintain CIS benchmark hardening on cluster node images, Kubernetes, cloud accounts and edge services; alert on drift.
• Run host, network and runtime detection across cloud nodes, feeding the SIEM; tune rules until every alert is actionable.
• Change VPCs, subnets and security groups directly through infrastructure-as-code.
• Scan nodes and containers continuously; patch critical CVEs within 48 hours.
• Run the secret store; rotate secrets and scan code, images and logs for leaks.
• Harden and monitor customer VPN servers.
• Publish a hardening baseline and release checklist for dedicated and on-premises customer deployments.
• Manage external penetration tests and bug reports; track every finding to a fix date.
• Watch infostealer feeds for customer platform credentials; force resets and alert the account owner.
• Supply SOC 2 evidence for change management, vulnerability management and logging.
• Run DAST against every web application and API before each release.
• Red-team our code: manual review and exploit testing of authentication, authorisation and tenant boundaries.

First 90 days

1. Inventory every internet-facing asset across all production regions and engineering infrastructure.
2. Review code, dependency and secret scanning coverage across all repositories; close the gaps.
3. Review detection coverage across every cloud node; ship the first ten tuned alerts.

What you bring

• 5+ years in application or product security, with prior software engineering experience.
• Reads and fixes Python backends and Angular/TypeScript frontends.
• Hands-on with AWS and Kubernetes security: IAM, network policy, secrets, workload hardening; operates infrastructure through Terraform or equivalent.
• Experience with MongoDB and PostgreSQL access control.
• Deep knowledge of OWASP Top 10, OWASP API Top 10, and authorisation flaws in multi-tenant systems.
• Prefers open-source tooling and automation over manual review.

Nice to have

• Experience securing LLM applications (OWASP Top 10 for LLM Applications).
• Open-source host, network and runtime detection tooling.
• Delivered software into air-gapped or sovereign environments.
• OSCP, OSWE or equivalent.