Security Engineer

Security Engineer

Job Description :

As a Security Engineer (Information Security), you will be a hands-on member of the Information Security team, helping to drive the security strategy in close alignment with business objectives. Working alongside Platform, Cloud and Engineering teams, you will strengthen the security posture of a PCI-DSS regulated core payments platform across cloud infrastructure and deployment pipelines.

The platform runs an estate of Windows servers on AWS and is moving rapidly to containers, Lambda and cloud-native services, managed as code. In this role your focus will be embedding security into release pipelines and securing the AWS environment. You will also drive vulnerabilities through to closure, keep security telemetry healthy, and pick up alerts escalated by the managed SOC (Arctic Wolf). You will also support the lifecycle of cryptographic keys, acting as a designated Key Custodian.

Roles and Responsibilities :

- Maintain and extend automated security guardrails in deployment pipelines (e.g., Checkov, Trivy, Snyk Enterprise, Renovate) to block preventable issues and enable engineers to ship securely.

- Embed security into Infrastructure as Code (IaC) patterns as the platform moves from a Windows server estate to containers, Lambda and cloud-native services, hardening release processes and collaborating with Platform Engineering and the security champions network.

- Triage and remediate AWS misconfigurations surfaced by AWS Security Hub, working closely with Platform and Engineering teams to resolve insecure configurations.

- Review overly permissive security groups, network paths and IAM permissions, ensuring strict adherence to the Principle of Least Privilege and Role Based Access Control (RBAC).

- Conduct periodic reviews and testing of security controls to validate that they work and remain aligned with organisational risk standards.

- Conduct risk scoring against vulnerabilities from Tenable (legacy estate), AWS Inspector (cloud-native) and Snyk to prioritise effort, ensuring patching tickets are raised, owned and actioned by the right teams and tracked through to completion.

- Monitor and maintain security telemetry so tooling is always running correctly, including log collectors, Arctic Wolf sensors and Sophos EDR agents feeding the Arctic Wolf SIEM.

- Investigate security alerts triaged by the Arctic Wolf 24/7 SOC and escalated via Slack, gathering evidence and following and improving incident response runbooks during active security events.

- Work with the MSSP to tune alerts (aligned to frameworks such as MITRE ATT&CK) and close detection gaps across AWS, Lambda and container workloads.

- Help strengthen escalation paths so that high and critical incidents raised outside UK business hours are not missed.

- Build automations to streamline security response and gather technical evidence for audits (e.g., PCI-DSS, ISO 27001, SOC 2).

- Support the lifecycle of cryptographic keys, from generation, distribution, rotation and storage to retirement and destruction, in accordance with policies and procedures.

Skills

Security, Information Security, iAM, AWS, Vulnerability Management, Security Tools, SIEM, PCI-DSS