{"id":2426338,"url":"https://alion.io/job/teya-principal-security-engineer-appsec","title":"Principal Security Engineer (AppSec)","company":{"id":684703,"name":"Teya","domain":"teya.com","url":"https://alion.io/company/teya","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":76,"open_postings":34,"ghost_share":0,"stale_share":0.971,"repost_share":0,"time_to_fill_p50_days":23,"computed_at":"2026-10-14T06:34:16Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":139000,"max_usd":246000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":20},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CVE","optional":false},{"name":"GDPR","optional":false},{"name":"Go","optional":false},{"name":"ISO 27001","optional":false},{"name":"PCI DSS","optional":false},{"name":"PKI","optional":false},{"name":"Red Teaming","optional":false},{"name":"Shift-Left","optional":false},{"name":"Shift-Left Security","optional":false}],"status":"live","first_seen_at":"2026-10-13T07:38:26Z","employer_posted_date":"2026-10-13","last_verified_at":"2026-10-14T08:28:01Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Hello. We’re Teya.\nTeya was founded on a simple belief: local businesses deserve better.\nThey are the cafés, restaurants, salons, shops and entrepreneurs that bring character to our high streets, create jobs and keep communities moving. Yet for too long, financial services has made life harder for them - with clunky tools, poor support and complexity that gets in the way of running a business.\nTeya exists to change that.\nWe’re building a financial platform for local businesses across Europe - one built around simple tools, thoughtful design and real human support. Our Members rely on us to help them run their business with confidence, and that responsibility shapes the way we work.\nWe move fast. We care about quality. We stay close to the detail. And we believe great performance and genuine hospitality should go hand in hand.\nIf you want to build meaningful products, solve real problems and make a genuine difference for local businesses, we’d love to hear from you\nAbout the role\nWe're a regulated payments fintech operating across multiple European markets, scaling into banking-licence territory. Security Engineering is being rebuilt around a joint operating model with our product, platform, and infrastructure teams. We're hiring a Principal Security Engineer to own the application security side of that model: how software gets designed, built, reviewed, and shipped safely across a growing engineering estate, and how security shows up as an accelerator rather than a toll gate.\nThis is not a review-queue role, and it is not a role about counting findings. We're not looking for someone to triage scanner output, chase \"critical\" CVE counts, or sign off tickets. We want an engineer who changes how the company builds software: transforming our SDLC into a secure SDLC, placing controls where they deliver the most value for the least friction, and making the secure path the default path.\nThe thread running through everything here is influence. You will spend as much time with engineers, product managers, designers, operations, and compliance colleagues as you do with code and tooling. The person who succeeds in this role is the person who can walk into any team, explain the risk in language that team actually uses, and leave them better equipped than when they arrived.\nWhat you'll work on\nFirst 90 days\nUnderstand how we actually build. Map our real delivery paths, from idea to production, across the teams that matter most. Find where security currently lands too late, too heavily, or not at all.\n\nBaseline the application estate. Establish a clear, honest view of coverage, risk, and the gaps between them. We would rather know the truth early than have a tidy dashboard.\n\nStart building relationships. Embed with engineering teams, run threat modelling with them rather than for them, and use those sessions to demonstrate what good looks like in practice.\n\nIdentify high-leverage controls. Identify what changes to the SDLC would measurably reduce risk while making delivery faster.\n\nFirst year\nSecure SDLC transformation. Design and roll out the controls, patterns, and checkpoints that make up our SSDLC. Proportionate, evidence-based, and justified by impact, not by convention.\n\nShift-left in practice, not as a slogan. Secure defaults in templates, libraries, and paved roads so that the easiest way to build something is also the safe way. Developers should hit guardrails rarely, and understand them when they do.\n\nPipeline-embedded controls. Work with the platform team to extend policy-as-code and build upon existing pipeline security toolchain (SAST, SCA, secrets, or DAST for example). Checks that run in the pipeline and produce signal engineers trust, not noise they learn to ignore.\n\nThreat modelling as routine practice. Make design-stage security a normal part of how teams work, scaled through enablement and templates rather than through your calendar.\n\nSecurity champions and enablement. Build a champions network, run training that engineers actually want to attend, and create the material that lets teams self-serve on the common questions.\n\nRisk that reflects reality. Move us from severity labels towards exploitable attack paths: what an attacker could actually chain together in our environment, and what that would cost us.\n\nThe 18-month direction\nThe strategy is that security scales through leverage and culture, not headcount. Your job is to build the patterns, tooling, and shared understanding that other teams operate against, and to make security a capability the business associates with speed and confidence rather than delay. If a control needs to be applied a hundred times, you build the way it applies itself, and you make sure the hundred teams understand why it exists.\nWhat you'll bring\nHard requirements\nDeep application security expertise, theoretical and practical. You understand application security concepts, concerns, and risks at depth, and you can reason about them in unfamiliar systems rather than only in the ones you've seen before.\n\nSDLC to SSDLC transformation experience. You've done this work, not just read about it. You know where and how to introduce security controls and steps that deliver the greatest value or impact while simultaneously accelerating developer velocity, and you can explain the trade-offs you chose and why.\n\nThe attacker mindset. You can think like a malicious actor: recognising real, actionable weaknesses and how they chain together into a genuine attack. This goes well beyond noting that a system is affected by x number of \"critical\" CVEs.\n\nFundamentals over familiarity. You understand security at a fundamental level, not just which capabilities exist on a given technology stack but what the controls on that specific platform, service, or tool actually do. We don't care whether you know a particular product. We care that you know enough to adapt to many, or any, tools and technologies to harden security posture.\n\nCommunication with non-technical audiences. You can take a complex technical concept and make it land with people who do not share your background, and you can do it comfortably and without condescension.\n\nA genuine team-first instinct. You have worked, and want to work, collaboratively across teams, functions, and skillsets towards a shared goal. You advise, enable, and persuade. You do not gatekeep.\n\nStrongly preferred\nPenetration testing knowledge or experience. Application, infrastructure and cloud, red teaming, and beyond. We're interested in the perspective it gives you, not in you running tests full time.\n\nFamiliarity with operating in a regulated environment. We are a regulated financial institution, and you would be supporting our compliance capabilities to maintain alignment with PCI-DSS, ISO27001, DORA, and many more.\n\nA developer and engineering mindset. A practical understanding of how software is built in a professional environment: not just the ability to write a script to achieve small tasks, but how engineering teams actually operate, prioritise, and ship.\n\nComfort engineering solutions with Go. Go is a part of our preferred technology radar and we build our security tooling in the same stack.\n\nPractical cloud security depth. Real-world cloud security practice: identity, workload isolation, and the patterns that hold up under production pressure.\n\nApplied cryptography exposure. Familiarity with the management or operation of PKI and HSMs, or applied cryptography more generally. Useful context in a payments environment.\n\nWhat we don't need\nCertifications in place of experience. CREST/OffSec, CISSP, CISM, and equivalents are welcome but not what we're hiring for.\n\nScanner operators. If your approach to application security is forwarding tool output to engineering teams with a due date attached, this is not the role.\n\nA pure offensive-testing career path. Offensive perspective is valuable here; full-time offensive work is coordinated separately.\n\nA GRC or auditor background. GRC is a separate function, and we work closely with it.\n\nSecurity as a veto function. If your instinct is to block first and discuss later, you will find this role frustrating and the teams here unreceptive.\n\nHow the team works\nOut-of-band, non-blocking. We embed in the pipeline, we do not sit in the critical path.\n\nSecurity is an enabler. We make the case for security in terms of delivery speed, resilience, and customer trust, and we expect to be held to it.\n\nSkin in the game is shared. Application owners own their app's security posture. We provide the patterns, tooling, and verification.\n\nAutomation first. If you're doing something manually more than twice, you automate it or you hand it back to the owning team.\n\nPublic requests, not DMs. All work in the open. Backlog visible. Decisions logged.\n\nWays of working matter. Defined split between roadmap, keep-the-lights-on, and unplanned work. We push back on unplanned demand with reasons.\n\nStraight talk\nThe function is being rebuilt. You will find undocumented processes, inconsistent coverage, and controls that exist on paper only. Fixing these is part of the role, not a surprise.\n\nA significant proportion of our application estate is behind on security review. We intend to close that gap through automation, culture, and ownership, not by adding manual reviews.\n\nCross-team relationships need repair in places. Influence will be your main tool, and some of it will need to be earned before it can be used.\n\nThe strategy exists on paper. Delivery discipline is still being built. If that's exciting, this is the role. If it's off-putting, it isn't.\n\nWhat we offer\nA function being rebuilt around leverage, automation, and clear boundaries, not another security-team-as-review-queue.\n\nReal mandate to reshape how a scaling engineering organisation builds software securely.\n\nDirect exposure to banking-licence-scale security work in a regulated payments environment, with PCI DSS, DORA, and GDPR as live constraints on the work.\n\nRoom to grow: Building and growing your own capability is mutually beneficial, and we want to support you in developing skills and capabilities to make you a better security engineer. this role is scoped as Principal, but there is a path to management as the function grows.\n\nHybrid working, competitive package, and a mandate to fix real problems.\n\nTeya is proud to be an equal opportunity employer.\nWe are committed to creating an inclusive environment where everyone regardless of race, ethnicity, gender identity or expression, sexual orientation, age, disability, religion, or background can thrive and do their best work. We believe that a diverse team leads to better ideas, stronger outcomes, and a more supportive workplace for all.\nIf you require any reasonable adjustments at any stage of the recruitment process whether for interviews, assessments, or other parts of the application-we encourage you to let us know. We are committed to ensuring that every candidate has a fair and accessible experience with us.","description_format":"text","description_chars":10998,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Hybrid work"],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Commerce","Financial Services","Business & SME Lending"],"lifecycle":[{"event":"open","at":"2026-10-13T07:58:47Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Skilled Worker, Senior or Specialist Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Skilled Worker; Global Business Mobility: Senior or Specialist Worker","cap_exempt":false,"checked_at":"2026-10-14T06:20:30+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.602,"p_room":1,"age_days":0,"expected_fill_days":23,"reasons":["conf:3","stale_co","win:early","comp:brand"],"computed_at":"2026-10-14T06:34:16Z"},"pay":null,"html_url":"https://alion.io/job/teya-principal-security-engineer-appsec","json_url":"https://alion.io/job/teya-principal-security-engineer-appsec.json","meta":{"generated_at":"2026-10-14T12:11:22Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14804,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":684703},"rest":"https://alion.io/mcp/rest/get_company?id=684703"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fteya-principal-security-engineer-appsec"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fteya-principal-security-engineer-appsec"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fteya-principal-security-engineer-appsec"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/teya-principal-security-engineer-appsec\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fteya-principal-security-engineer-appsec"}]}