Arrive - Senior Product Security Engineer

About Arrive

Arrive, including brands like EasyPark, Flowbird, RingGo, ParkMobile and Parkopedia, is a leading global mobility platform. Present in over 90 countries and 20,000 cities, the company helps people and decision-makers make smarter decisions about urban mobility and ease the experience of travel worldwide.

Role Overview

We are seeking a Product Security Engineer to strengthen the security posture of our applications and cloud-native platforms. This role focuses on proactive application security testing, vulnerability management, secure SDLC integration, and collaboration with engineering teams.

Key Responsibilities

Application & API Security :

• Conduct manual and automated penetration testing of web applications and APIs.
• Identify and validate vulnerabilities aligned with OWASP Top 10 and API Security Top 10.
• Perform threat modeling for new features and services.
• Conduct secure code reviews (static analysis) and recommend remediation.
• Validate findings from SAST, DAST, and dependency scanning tools.
• Provide remediation guidance and conduct fix verification testing.
• Participate in design reviews and architecture discussions from a security perspective.

• Assess AWS/Azure/GCP configurations for common misconfigurations.
• Review IAM policies, storage access controls, and container security posture.
• Validate findings from CSPM/CNAPP tools.
• Support cloud-native application security assessments.

• Prioritize vulnerabilities using CVSS and business impact context.
• Track remediation SLAs and support risk acceptance decisions.
• Provide actionable recommendations to development teams.

• Develop scripts and tooling (Python/Bash) to automate testing workflows.
• Improve security testing playbooks and documentation.
• Contribute to enhancing detection and monitoring coverage.

• Prepare high-quality technical reports with clear risk articulation.
• Translate technical findings into business-impact language.
• Work cross-functionally with DevOps, Cloud, and Engineering teams.

• 6 - 9 years of experience in Application Security, Product Security, or Offensive Security.
• Hands-on experience conducting web and API penetration testing.
• Strong understanding of OWASP Top 10 and common attack vectors.
• Experience using tools such as Burp Suite, OWASP ZAP, Nmap, Snyk, Checkmarks, etc.
• Experience working with cloud platforms (AWS/Azure/GCP).
• Familiarity with container security and modern DevOps environments.
• Experience reviewing code for security issues.
• Strong understanding of HTTP, authentication mechanisms, and networking fundamentals.
• Basic scripting experience (Python, Bash, or similar).

• Experience in SaaS, fintech, or product-based organizations.
• Exposure to Kubernetes and container security testing.
• Familiarity with bug bounty or responsible disclosure programs.
• Experience implementing DevSecOps practices.
• Certifications such as CEH, Security+, eJPT, OSCP (nice to have).

(ref:hirist.tech)