This position plays a key role in ensuring Thought Machine teams are taking all required steps in building a secure product set. You will play a major and leading role in protecting Thought Machine product against security risks, with influence to implement cutting-edge measures to minimise exposures and vulnerabilities.
Whether engineering a system to address a technical security hurdle, protecting our customers' data, or consulting on a wide range of security topics, you are empowered to engage and lead cross-functionally.
A large part of Thought Machine product security function is a greenfield challenge, we are building the bank of tomorrow with cutting edge web technology, no best-practice/of the shelve security frameworks or tools can solve our security challenge. We are building the best security to enable engineering and impress financial service auditors. Key qualities of the ideal candidate would have experience in OWASP top 10 vulns, devsecOps, data privacy protection, passion to mentor and enable devs, creativity, autonomy, ability to work and complete multiple projects simultaneously.
DUTIES
Drive improvements to Thought Machines product security posture through strategic planning and collaboration with both development and infrastructure teams, with trust, autonomy and influence.
Produce production web scale grade application security design.
Review and produce data privacy and financial regulatory functional and nonfunctional designs.
Perform design reviews and Threat modeling of Thought Machine services and products.
Perform vulnerability assessments and security testing.
Providing subject matter expertise on all areas of security and privacy throughout the Software Development lifecycle.
Liaison with development teams for design, code reviews & education.
To contribute to security strategy, security tooling selection and creation.
Conduct regular security assessments and code reviews.
REQUIREMENTS
Essential
Expertise with a programming language (e.g. Python, Go or Java)
Experience of security in a DevOps environment
Experience in web application penetration testing and security tooling (e.g. Burp proxy, Web/Network Scanners, Static code analysers, etc).
Coding experience for automating/integrating security tools and creation of security tools.
Knowledge of security in distributed systems at scale.
Cloud and containers technology knowledge (e.g. AWS, GCP, Kuberbetes, Docker)
Experience of performing security design reviews, threat modelling and risk assessments
Knowledge of application security issues
Desirable
Professional security qualifications are desirable (e.g. CISSP, Offensive Security, Sans Institute, etc.)
Contributions to the security community (public research, blogging, presentations, etc)
Awareness and experience of the Data Protection Act, ISO 27001 and PCI-DSS
Benefits
Highly competitive salary
Voluntary Pension Plan (match up to 5%)
Private Healthcare Insurance
Comprehensive Life Insurance
25 days holiday plus public holidays
Two charity days a year
Daily Meal Allowance
Access to outstanding learning materials and courses
Sports and hobby clubs, subsidised by Thought Machine
All the latest tech you need
Huge range of healthy (and not-so-healthy) snacks, smoothies and drinks
A talented and experienced team as your colleagues
An environment where we encourage learning and progress
We actively hire candidates who demonstrate technical excellence in their field and welcome people of all ages and backgrounds, providing everyone with equal access to professional development. You are encouraged to apply even if your experience doesn't accurately match the job description. We also encourage applications from those with different abilities, including candidates with ADHD, autism, dyslexia or dyspraxia.
