Senior Security Engineer

Senior Security Engineer

You'll own security across the stack — the applications, the Kubernetes platform they run on, the pipelines that ship them, and the edge in front. AWS and Azure. Hands-on, on a platform that moves money and verifies identity under regulatory obligation. You'll write code, build controls, break things on purpose, and sit with the platform and backend teams rather than filing findings and waiting.

Key Responsibilities

• Threat model the flows that matter — auth, sessions, payments, wallet, bonuses — and drive mitigations to closure
• Harden the clusters: RBAC, namespace boundaries, network policies, admission control, pod security, runtime posture
• Review design and code across Node.js and TypeScript services — API authz, input handling, the OWASP baseline enforced in practice
• Secure the pipeline: SAST, SCA and secret scanning as merge gates, image scanning and signing, pinned digests, least-privilege CI creds
• Own secrets and keys — sourcing, injection, rotation, revocation, KMS, and keeping credentials out of the repo and out of logs
• Tune the edge: WAF rules, rate limiting, bot and credential-stuffing controls, DDoS posture, origin protection
• Build detection: security telemetry pipeline, rules for account takeover and abuse, alerts people act on, runbooks you've actually rehearsed
• Run vulnerability management — triage by exploitability and blast radius, remediation SLAs, external pentest coordination and closure
• Produce the evidence auditors and regulators ask for: access control, audit trails, data residency, retention, change control
• Take part in incident response and write up what stops it recurring.

Skills & Experience

• 4+ years in security engineering, at least 3 securing cloud-native production systems on AWS or Azure
• Kubernetes security in depth: RBAC, network policies, admission controllers, runtime hardening, and the failure modes of each
• Application security with JavaScript and TypeScript services — able to read and review the code, not just scan it
• Cloud security depth: identity, segmentation, key management, logging, guardrails
• IaC and supply chain hardening with Pulumi or Terraform, plus tooling you've implemented rather than evaluated
• CDN and edge security, Cloudflare especially: WAF tuning, rate limiting, bot management, TLS, edge-to-origin trust
• Threat modelling with the judgement to rank risk by exploitability, not scanner severity
• Detection engineering and SIEM work — writing rules, cutting noise, proving coverage
• Incident response in production, including the write-up afterwards
• Scripting in Python, Bash, Go or TypeScript

Know someone who could be a great fit for this opportunity Or is this role your next career move

We'd love to hear from you! Share your updated resume at [Confidential Information] and let's explore the possibilities together.