Security Engineer

• Lead security engineering for the Python/Django/React application, including code reviews, threat modelling, and security design reviews
• Own static analysis, dependency scanning, and secret scanning in CI; triage findings
• Coordinate penetration testing, internal red team testing, and third-party testing; drive remediation
• Partner with engineers to establish secure coding standards and provide practical guidance
• Enforce SSO/MFA for internal tooling; manage onboarding, offboarding, and access reviews
• Secure and audit staff platform access
• Collaborate with the Platform team to secure AWS IAM, network architecture, secrets management, and compute/data layers
• Define and automate infrastructure security baselines, including container security and CI/CD pipeline integrity
• Lead secure architecture reviews for new systems and significant infrastructure changes
• Build and maintain detection capabilities across application, cloud, and SaaS systems
• Manage security incident response, including triage, containment, investigation, communication, and post-incident review
• Develop runbooks and response playbooks
• Contribute to the SOC2 compliance program, evidence collection, control monitoring, and audit readiness
• Conduct vendor and customer security assessments
• Communicate security risks and drive remediation prioritisation
• Maintain security policies and documentation
• Define the security roadmap and prioritise based on impact and risk
• Represent security in architecture decisions
• Mentor engineers and staff and build a security-first culture
• Report on security posture to leads and departments
• Advise on internal IT and physical security initiatives

• 7+ years in engineering
• 5+ years of hands-on security experience in a product security, application security, or security engineering role
• Experience with threat hunting, threat intelligence, or red team activities
• Strong Python/Django application security knowledge
• Solid AWS cloud security experience covering IAM, network controls, and secure architecture patterns
• Practical incident response experience, including experience being on call
• Experience leading a security incident
• Working knowledge of SOC2 or a comparable compliance framework mapped to engineering practice
• Ability to communicate risk clearly to technical and non-technical audiences
• Comfort working autonomously in a remote, cross-timezone environment
• Relevant certifications such as OSCP, CISSP, AWS Security Specialty, or similar are a bonus

• A competitive salary in a fast-growing startup
• Four weeks of paid vacation leave per year
• Two weeks of paid sick leave per year
• Paid Parental Leave
• A company laptop
• Monthly internet allowance/reimbursement
• Office set-up allowance
• Annual learning and development allowance
• The ability to work how you want; employees are trusted to figure out the best way to work
• Remote work from home or a co-working space
• Support from a friendly and fun international team