Staff Product Security Engineer

Overview

In this role, you drive triage, assessment and resolution of product security vulnerabilities across Arm hardware and software. You lead incident response and coordinated vulnerability disclosure, working with engineering, legal, and external partners to safeguard customers. You’ll strengthen PSIRT processes and engage with researchers and industry bodies to uphold best practices. This is a hands-on position shaping how Arm handles vulnerabilities at scale, in a collaborative, cross-functional environment.

Pay / Benefits

• hybrid working
• equal opportunities
• recruitment accommodations

Responsibilities

• Triage, assess, and resolve product security vulnerabilities across Arm hardware and software
• Lead and coordinate product security incident response across engineering, business, customers, and partners
• Own coordinated vulnerability disclosure activities including strategy, timelines, customer communications, CVE assignment, and advisory publication
• Represent Arm in security engagements with researchers, customers, partners, and the wider security community
• Support and evolve Arm’s bug bounty programs with high-quality assessment and coordination
• Improve PSIRT processes, tooling, metrics, and incident response practices
• Ensure accurate, timely vulnerability handling aligned with industry best practices

Key requirements

• Experience in a PSIRT, vulnerability disclosure, or bug bounty triage role
• Working knowledge of CVE processes, advisories, severity assessment, and remediation coordination
• Ability to communicate clearly with technical and non-technical stakeholders across time-sensitive situations

• Pragmatic and collaborative mindset
• Calm under pressure
• Clear communication and trust-building in vulnerability handling
• Experience with hardware and/or software vulnerability handling
• Familiarity with bug bounty programs
• Knowledge of CVSS scoring

…