Senior Security Engineer

• Architect and lead the design and implementation of security controls across cloud infrastructure, applications and CI/CD pipelines
• Coach and mentor developers, engineers and architects on secure design, threat modelling and cloud security
• Own vulnerability management and attack surface management, prioritising real exploitability and driving findings to closure
• Own SDLC security by integrating and tuning SAST, DAST and SCA
• Engineer and maintain cloud security posture, primarily in AWS and Cloudflare
• Own detection and response end to end, including logging, alerting, investigation, remediation and post-incident write-ups
• Architect and guide IAM strategy for least-privilege human and machine identities
• Perform offensive security testing against infrastructure, applications and identity flows
• Use AI tooling for triage, code review, detection engineering, evidence collection and toil automation
• Secure AI systems as they are adopted
• Automate repetitive security work
• Deliver uncomfortable assessments with an actionable plan and first pull request

• 5+ years hands-on in a technical security engineering role, including time accountable for implementing fixes
• Track record of designing and delivering security architecture into production
• Judgement across security engineering, IT security, security operations and offensive security
• Deep AWS security experience: IAM, Organizations and SCPs, Security Hub, GuardDuty, WAF, and Cloudflare
• Production programming with Python, Go, Bash; TypeScript is a major plus
• Infrastructure as Code and knowledge of drift, over-permissive modules, secrets in state, and pipeline privilege escalation
• Personally run vulnerability and attack surface management
• Solid SIEM and detection engineering knowledge
• Hands-on detection and response experience, including real alert investigations and post-incident reviews
• Working offensive security knowledge
• Practical current use of AI in security work
• Current understanding of AI-driven threats
• Experience integrating and tuning SAST, DAST and SCA
• Ability to work autonomously and closely with engineers
• Comfort with open technical debate
• Nice to have: Hands-on PCI DSS experience
• Nice to have: Experience building and maintaining a SIEM
• Nice to have: Serverless and event-driven architecture at scale
• Nice to have: iGaming, fintech or another regulated, high-value-target industry experience
• Nice to have: Corporate IT security, including SSO, identity providers, MDM, SaaS security posture, and third-party/vendor access
• Nice to have: Experience securing AI or agentic systems
• Nice to have: NIST CSF, CIS Benchmarks, or CSA CCM experience
• Certifications such as CISSP, AWS Certified Security or CEH are welcome

• A lean, focused company, offering a flexible working environment
• The opportunity to work with and learn form a highly skilled, talented team
• A great company culture, where accountability is innate, transparency is key and competency is virtue
• Being part of a tight knit, caring community
• Work equipment of your choice
• Private health insurance
• Learning budget
• Company wide and team based get togethers