Security Engineer

StructureIt is a growing software consultancy in the capital markets, with offices in the UK, South Africa, Mauritius, India and New Zealand. We are trusted partners that help our customers in the Commercial Real Estate and Credit Markets in capital markets, insurance and telecoms leverage technology to unlock value throughout their business. Our mission is to deliver high-quality and robust software that quickly solves customer pain points while keeping them in control throughout the engagement.

Why this role exists

We are a financial consultancy working for an industry-leading global financial data company. Our staff and our coding agents use AI every day, and the systems we build for clients now include language models and agents. Security has to keep up with both.

You are the security engineer who covers all of it. You penetration-test the systems we build and our own estate, you secure how we use AI, and you run the controls that protect our staff in the UK, South Africa and Mauritius. You design the controls, test them yourself and fix what you find.

The role sits in our IT Operations team, so you also engineer and support the IT estate itself: firewalls and Azure, accounts and laptops, and the service desk. Part of each week goes to that work. We keep meetings to a minimum and give you the freedom to do it.

What you'll own

Penetration testing

You test our own estate on a schedule and after major changes. You also work with our delivery teams to build penetration tests for the systems they develop, starting from a threat model and running in the build pipeline. You coordinate the external penetration and phishing tests and track every finding to closure. Your work means the external testers find less each time.

AI security

You set the controls for how our staff and agents use AI: approved tools and models, agent permissions and keys, client data kept in approved tools, and third-party skills and MCP servers checked before anyone installs them. Where a system we build uses models or agents, you test it for prompt injection, data leakage and excessive agency. You use AI yourself too, and build agents and skills that run security checks for you and for the delivery teams.

Identity and device security

You administer Microsoft Entra ID: users, groups, Conditional Access policies, and SSO and SCIM integrations with our SaaS applications. You design the Conditional Access policies as well as maintain them. You manage device compliance with Intune and Defender for Endpoint, including BYOD checks and remediation of non-compliant devices.

Security operations

You investigate security alerts and incidents, such as Defender detections, unapproved software and unmanaged devices, and record what you found. You threat-model our infrastructure, SaaS integrations and changes with MITRE ATT&CK, and define the mitigations and detections. You run vulnerability management with OpenVAS/Greenbone and Dependency-Track. You implement and evidence our ISO 27001 controls, and you complete client security questionnaires.

IT engineering

You maintain our Palo Alto firewalls, GlobalProtect VPN and Zscaler Private Access, including PAN-OS upgrades. You maintain our Azure infrastructure: virtual networks, private DNS zones, Key Vault, SQL access and virtual machine lifecycle. You raise and document a change request for every infrastructure and configuration change, and you write and maintain scripts that automate repeat tasks.

IT support

You resolve service requests and incidents in Jira Service Management within the agreed SLAs. You run joiners, movers and leavers: account creation, role changes, access removal on the last working day, and evidence capture. You provision, configure, wipe and replace Windows and macOS laptops, and keep the asset records current. You manage SaaS licences and access across Google Workspace, Microsoft 365, Atlassian, Slack and our AI tools.

What you won't own

The compliance programme. Governance, policy and the audit programme sit with our Chief Compliance Officer.

The code. Our delivery teams own the systems they build and fix what you find.

Who you might be

Your job title matters less to us than the security work you have done. You might be:

• A penetration tester who wants to run controls as well as test them.
• A Microsoft security engineer who has penetration-tested the estate they secured.
• An application security engineer who wants to own infrastructure security as well.
• An infrastructure engineer whose main job for the last three years has been security.

Whatever the background, you have run a penetration test and written the report, handled a real incident, and designed a control that you then operated. You are also happy to do hands-on IT engineering and support alongside the security work. This is a security role first, though. If security was a side task in your last IT support or sysadmin role, this one will not suit you.

Skills and experience

• At least five years in IT, infrastructure or software, with three or more in a role where security was the main job.
• Penetration testing of web applications, APIs, internal networks, Active Directory and Azure, with tools such as Burp Suite or OWASP ZAP.
• Threat modelling with STRIDE or MITRE ATT&CK, and working knowledge of the OWASP Top 10 for LLM Applications.
• Hands-on administration of Microsoft Entra ID and Active Directory, including Conditional Access policies you designed and enforced, and SSO (SAML/OIDC) and SCIM provisioning.
• Microsoft Intune and Defender for Endpoint, and support of Windows, macOS and Linux endpoints.
• Microsoft Azure infrastructure (networking, DNS, Key Vault), firewalls, and site-to-site and client VPNs.
• Incident investigation and response, and vulnerability management through to closure.
• Daily use of AI tools such as Claude, ChatGPT or Gemini, and scripting in PowerShell, Bash or Python.
• Work from a ticketing system with SLAs, such as Jira Service Management, following documented processes and capturing evidence for each task.
• ISO 27001 or a similar control framework, and clear writing for tickets, change requests and audit evidence.
• Advantageous: OSCP, CREST CRT or PNPT. CISSP, CISM or CCSP, or a Microsoft security or Azure certification such as SC-300 or AZ-104. Digital forensics. Palo Alto PAN-OS and GlobalProtect. Zscaler Private Access. Google Workspace administration. AWS. Testing LLM applications or agents in production. Building AI agents.

The interview includes a practical exercise. You threat-model and test a deliberately vulnerable web application with an LLM feature, using AI tools if you want to, and you walk us through an incident you handled.

How we'll measure success

Over the first 12 months, success looks like:

• the estate penetration-tested on an agreed schedule, with every finding tracked to closure
• each delivered system carrying its own penetration tests, including LLM tests where relevant
• fewer findings in each external test, and none repeated from the last
• every AI tool in use approved and connected to Entra ID
• service requests and incidents resolved within the agreed SLAs, and asset records that match the devices in use
• and every device compliant, every leaver's access removed on their last day, and ISO 27001 evidence kept current

Targets are agreed with you in your first month, against a baseline you have measured.