Product Security Co Coordinator

A product security coordinator helps keep the security side of a company's products organised - tracking known vulnerabilities (weaknesses in software or hardware that attackers could exploit), chasing engineering teams to fix them, and making sure security checks actually happen before a product ships. The job sits between security specialists, engineering teams and compliance or legal people, and it is as much about coordination, documentation and follow-up as it is about technical analysis. It typically exists in companies that sell software, connected devices, medical equipment, vehicles or industrial kit, rather than in organisations that only run internal IT.

Starting salary: £26k–£35k
Live graduate jobs: Search all jobs
Main way in: Direct entry from a graduate job advert in cyber security…
They usually ask for: A degree is usually expected but the subject is flexible

Approximate graduate salary

Typically somewhere around £26,000–£35,000 to start, as a broad approximation. This varies widely - London, defence, finance and large technology employers tend to sit at the upper end or above it, while smaller firms and regional roles often start lower. Treat any figure as indicative only and check individual adverts.

What you'd actually do

Tracking a backlog of security findings - from automated scanning tools, penetration tests (authorised simulated attacks on a product), or researchers reporting bugs - and making sure each one has an owner, a severity rating and a target fix date.
Chasing engineering teams in stand-ups and over chat for updates on fixes that have slipped, and escalating the ones that are overdue and genuinely risky.
Maintaining the paperwork trail: security requirement checklists, risk registers, evidence that a review happened, records showing which open-source components are in a product and whether any have known vulnerabilities.
Scheduling and coordinating security activities - booking an external penetration test, arranging a threat modelling workshop (a session where the team maps out how a product could be attacked), making sure the right people turn up.

Show 3 more

Monitoring vulnerability feeds and advisories for issues affecting components the company's products rely on, and flagging the ones that matter to the relevant team.
Helping prepare responses when a customer, auditor or regulator asks security questions about a product - pulling together evidence, filling in security questionnaires, drafting sections of a customer-facing advisory.
Reporting: producing the weekly or monthly summary of open issues, overdue fixes and upcoming assessments for engineering managers or a security lead.

How graduates get in

Direct entry from a graduate job advert in cyber security, product security or security governance - the most common route. Employers hiring at this level are usually looking for organisation and technical literacy rather than deep hacking skill.
Via a broader graduate scheme in technology, engineering or cyber security at a larger company, then rotating or being placed into the product security team.
Internal moves are very common and often the easiest way in - starting in a service desk, QA/testing, technical support, project coordination or junior engineering role and moving across once you understand the company's products.
A placement year or summer internship in a security or engineering team, converted into a graduate offer. Worth targeting if you are still at university.

Show 2 more

Apprenticeship routes (cyber security technologist and similar) are a realistic non-graduate path into the same work, and degree apprenticeships exist at some larger employers.
Less commonly, moving from a security analyst role in a security operations centre (the team that monitors live attacks) into product-side work - this is more of a sideways move than a graduate entry point.

What employers ask for

A degree is usually expected but the subject is flexible. Computer science, cyber security, software engineering, electronics and information systems are the obvious fits; other numerate or technical degrees are often accepted if you can show genuine security interest.
Grades: many employers ask for a 2:1, but a 2:2 plus relevant experience, a certification or a strong technical portfolio is frequently enough - this varies a lot by employer size.
Technical literacy rather than deep expertise: understanding what a vulnerability is, how software is built and released, how CVSS scoring works (a standard way of rating how severe a vulnerability is), and basic familiarity with cloud or embedded systems depending on the product.
Entry-level certifications help and are sometimes funded by the employer rather than required up front - CompTIA Security+ is the common starting point; ISO 27001 awareness or a foundation project qualification is sometimes valued in more governance-heavy versions of the role.

Show 2 more

Evidence of organisation under pressure - coursework projects, society committee roles, part-time work involving tracking lots of moving parts. This is genuinely assessed, because the job lives or dies on follow-up.
Security clearance may be required in defence, government-facing or critical national infrastructure employers, which usually means UK residency requirements. Check adverts carefully.

Skills that matter

Vulnerability triage and prioritisation

You will see more reported issues than anyone can fix at once, so judging which genuinely threaten customers and which can wait is the core judgement call of the job.

Written clarity for mixed audiences

The same issue has to be explained one way to a developer, another way to a product manager who wants to know whether the launch date moves, and another way again to a customer in a security advisory.

Polite persistence

You usually have no authority over the engineers who need to do the fixing, so progress comes from consistent, non-annoying follow-up and knowing when to escalate.

Understanding of the software development lifecycle

Knowing how code moves from branch to release, and where sprints, code reviews and release gates sit, tells you where a security check can realistically be inserted without the team ignoring it.

Data handling and tracking tools

Most of the role runs through issue trackers, spreadsheets and dashboards, and being able to query, filter and summarise that data turns a messy backlog into a report someone will act on.

Familiarity with security standards and frameworks

Product security work is increasingly driven by external requirements - things like ISO 27001, IEC 62443 for industrial systems, or product regulations for connected consumer devices - and knowing the vocabulary makes you useful in audits and customer conversations.

Putting these on a CV? We counted which skills 12,914 live graduate adverts ask for, and what to do with the answer — part of our application advice.

Where it leads

First year or two: learn the product portfolio, own the vulnerability tracker and routine reporting, build relationships with engineering teams. Progress here is mostly about being trusted to chase things without supervision.
Product Security Analyst or Engineer: taking on the technical analysis yourself - reviewing threat models, assessing findings rather than just routing them, running elements of a penetration test engagement. This is the most common next step and often happens within a few years, though timelines vary widely by employer size.
A fork in the road: the technical path (security engineer, application security engineer, penetration tester, embedded security specialist) or the governance path (security compliance, risk, audit, certification lead). Both are viable; the technical path usually needs you to actively build hands-on skills outside the day job.
Senior / lead product security roles: owning security for a whole product line, running the incident response process for customer-reported vulnerabilities, representing the company to auditors and large customers.
Longer term: product security manager, head of product security, or into wider roles such as security architect or CISO-track leadership. These timelines vary enormously - there is no conventional fixed ladder, and moving between employers is often faster than waiting internally.

What people get wrong

“It's a hacking job - you'll spend your days breaking into things.”

Hands-on offensive testing is usually done by specialist penetration testers or external firms. A coordinator's value is in making sure findings get fixed, evidenced and closed, which is largely organisational work. Some roles grow a technical element over time, but if you want to break things all day, look at penetration testing roles instead.

“"Coordinator" means it's an admin job with no career ceiling.”

It is genuinely coordination-heavy, but it gives you an unusually wide view of how products are built, where risk actually sits and who makes decisions - which is why it often leads into engineering, architecture or security leadership faster than a narrow technical start would.

“It's the same thing as working in a security operations centre or IT security.”

Those roles defend the organisation's own networks and respond to live attacks. Product security is about the thing the company sells to customers - its design, its components, its releases and its published vulnerability advisories. Different stakeholders, different rhythm, different skills.

“You need a cyber security degree and certifications before anyone will look at you.”

Plenty of people enter from general computing, engineering or even non-technical degrees with demonstrated interest. Many employers fund entry-level certifications once you are in, and the harder thing to teach is the follow-through and communication the job depends on.

Where this varies

The title is used quite loosely and the job behind it differs a lot. In a software or SaaS company it tends to be close to application security - vulnerability tracking, scanner output, dependency management. In hardware, automotive, medical device, aerospace or industrial companies it leans towards regulated product security, with heavy emphasis on standards, certification evidence and long product lifecycles where a fix can take months rather than days. In a smaller company you may be the only person doing this and the role will sprawl into general IT security; in a large one you will be one coordinator among a specialist team with a much narrower remit. Defence and government-facing employers add security clearance and nationality requirements. The balance between technical analysis and project-style coordination is the single biggest thing to ask about at interview.

Search Product Security Co Coordinator jobsFrom employers' own careers sites, updated daily Tailor your CV for this roleFree with an account, 3 a month

General guidance about the role across the UK market, not about any specific employer. Entry routes and requirements vary — always check the individual job advert.