What you'll be doing

• Understand the actual software delivery process and identify where security is lacking or overly burdensome.
• Assess the current application security posture, covering risk and gaps honestly.
• Build strong relationships with engineering teams and collaboratively run threat modelling sessions.
• Identify and implement high-impact security controls that reduce risk while speeding delivery.
• Design and implement a secure software development lifecycle (SSDLC) with justified, evidence-based controls.
• Enable shift-left security by embedding secure defaults in templates, libraries, and development paths.
• Collaborate on pipeline security tools, improving signal quality and reducing noise.
• Make threat modelling a routine design practice through enablement and standard templates.
• Establish and nurture a network of security champions and provide engaging training and self-serve materials.
• Develop risk assessments that focus on realistic attack paths and business impact rather than just severity labels.
• Build scalable security solutions and culture to enable fast, confident, and secure software delivery across multiple teams.

Requirements

• Deep theoretical and practical expertise in application security with strong reasoning in unfamiliar systems.
• Proven experience transforming SDLC into a secure SDLC that accelerates developer velocity.
• Ability to think like an attacker to identify real, actionable vulnerabilities and exploit chains.
• Strong understanding of security fundamentals and ability to adapt across various tools and platforms.
• Excellent communication skills for conveying complex security concepts to non-technical audiences without condescension.
• Collaborative, team-first mindset committed to enabling and persuading rather than gatekeeping.

Nice to haves

• Knowledge or experience in penetration testing including application, infrastructure, cloud, and red teaming.
• Familiarity with regulated environments and compliance standards such as PCI-DSS, ISO27001, and DORA.
• Developer and engineering mindset with practical understanding of professional software development and team workflows.
• Experience engineering solutions using Go programming language.
• Real-world cloud security expertise including identity, workload isolation, and production-ready patterns.
• Exposure to applied cryptography, including PKI and HSM management relevant to payments environment.

Perks and benefits

• Opportunity to rebuild a security function focused on leverage, automation, and clear boundaries rather than just review queues.
• Mandate to significantly reshape security practices in a scaling engineering organization.
• Exposure to banking-licence-scale security work within a regulated payments environment with live PCI DSS, DORA, and GDPR constraints.
• Room for professional growth including skill development and potential transition to management roles.
• Hybrid working environment and competitive compensation package.
• Commitment to equal opportunity employment and creating an inclusive, supportive workplace for diverse backgrounds.
• Reasonable adjustments during recruitment to ensure a fair and accessible candidate experience.