Senior Security Engineer

Description

The company aims to cut the time teams spend on data work by 90%. Its enterprise platform lets teams automate data controls using no-code tools, cloud services and AI.

One platform automates data processing from end to end, covering structured files like spreadsheets and RTFs as well as unstructured PDFs and emails. Clients use it to act faster, cut costs and risk, and meet regulatory obligations.

Headquarters are in London, with offices in New York, Wrocław, Singapore and Antwerp. Clients include more than 15 of the world's largest international banks, along with brokers, exchanges, asset managers, hedge funds, administrators, service providers and corporates.

This role sits in the Information Security team and covers threat detection, response and prevention for the AWS-hosted SaaS platform. You will be the internal owner of the SIEM and the managed SOC, set the detection strategy, hold the SOC provider to strict standards, lead incident response, and own run-time security across the AWS estate.

The team is small and collaborative, split between London and Wrocław. You will work with GRC, the Senior Product Security Engineer (who handles SDLC and CI/CD pipeline security), Engineering, Platform and IT, and report to the Head of Information Security.

Responsibilities

• Cloud and corporate security:
• Own run-time security across the AWS environment, covering IAM, organisational guardrails, logging coverage and fixing cloud security findings.
• Protect corporate systems including Google Workspace, endpoints and SaaS apps, working with IT to set and enforce identity, access and device standards.
• Vulnerability and exposure management:
• Lead the infrastructure vulnerability management programme, ranking fixes by risk and driving delivery with the Platform and IT teams.
• Build and run external attack surface management.
• Manage infrastructure and external penetration tests, from scoping through to closing remediation.
• Detection and incident response:
• Own the SIEM, including onboarding log sources, building and tuning detection use cases, and tracking coverage against MITRE ATT&CK.
• Serve as the internal owner of the managed SOC relationship, covering escalation runbooks, service reviews, triage quality and SLAs.
• Lead security incident response from triage and containment through post-incident review and root cause analysis.
• Track emerging threats and propose improvements to detection and response.
• Automation, reporting and assurance:
• Automate repetitive security work using scripts and infrastructure-as-code.
• Produce operational security metrics that feed risk reporting and key risk indicators (KRIs).
• Support internal audits and client assurance by showing that operational security controls work as intended.

Requirements

• Proven experience in security operations or cloud security engineering.
• Hands-on SIEM work, including designing and tuning detections and responding to alerts.
• Deep knowledge of AWS security services and architecture, including IAM, Organizations, Service Control Policies (SCPs), CloudTrail, GuardDuty, Security Hub, KMS and VPC design.
• Experience securing containers and Kubernetes at runtime, ideally on Amazon EKS.
• A record of leading security incident response in cloud environments.
• Experience working with or managing a managed SOC or Managed Detection and Response (MDR) provider.
• Proficiency in Python or a similar scripting language for automation.
• Working knowledge of infrastructure-as-code.
• Ability to explain technical risk clearly and concisely to non-technical stakeholders.
• Desirable: experience with detection-as-code practices.
• Desirable: experience with SOAR platforms or automated response playbooks.
• Desirable: experience with CSPM or CNAPP tooling.
• Desirable: familiarity with financial services regulations and standards such as DORA, ISO 27001 and SOC 2.
• Desirable: relevant professional certifications such as AWS Certified Security Specialty, GCIH, GCIA or GCFA.
• Desirable: experience applying threat intelligence to set detection priorities.

Conditions

Hybrid working under the flexible policy, with 2 days per week in the office.

Team based across London and Wrocław.

Reports to the Head of Information Security.

Benefits

• Competitive salary aligned with your skills and experience, reviewed annually.
• Annual performance-based bonus.
• Healthcare cashback scheme and private medical insurance.
• Life assurance at 4X salary.
• Unlimited annual holiday.
• Enhanced family leave.
• Employee Assistance Programme.
• Cycle to Work and Tech Scheme.
• 4 volunteering days off per year.
• Opportunity to work abroad for up to 6 weeks per year.
• Personal learning and development opportunities.
• Referral bonus for recommending someone the company hires.
• Spot Rewards.
• Employee of the Month and Employee of the Year awards.