Security Engineer

About this role

Security owns the safety of a platform holding identity documents, salary data and CVs across several jurisdictions.

Work alongside engineering on the security of a platform holding identity documents and salary data: reviews, threat models, and the tooling that catches the rest.

The threat model is specific: account takeover, document forgery, automated abuse at scale, and people impersonating employers to defraud job seekers. That last one is why Trust & Safety exists as a separate function and why we work closely with it.

Primary responsibilities

• Secure a platform holding identity documents, salary data and CVs across several jurisdictions
• Threat-model new features alongside the engineers building them rather than reviewing at the end
• Review code and architecture for the failure modes that matter here: broken access control between tenants, insecure direct object references, and anywhere a file upload becomes an execution path
• Own the application security tooling — SAST, dependency scanning, secret detection — and keep the signal-to-noise good enough that people act on it
• Run the vulnerability management process from finding to fix, with real deadlines
• Write findings so a developer can act on them, rather than forwarding a scanner report
• Support incident response when the incident is a security one

Skills required

Day to day this role works with AppSec, Threat Modelling and Cryptography.

• Three or more years in application security
• Can read the code, not only the scanner output
• Four or more years in application or product security
• Threat modelling done alongside engineers rather than as a review gate