Be at the heart of actionFly remote-controlled drones into enemy territory to gather vital information.

Apply Now

Senior Security Engineer (Product Security)

Ebury
Greater London
3 weeks ago
Create job alert

Ebury is a global fintech firm dedicated to empowering businesses to expand internationally through tailored and forward-thinking financial solutions. Since our founding in , we’ve grown to a diverse team of over 1, professionals across 40+ offices and 29+ markets worldwide. Joining Ebury means becoming part of a collaborative and innovative environment where your contributions are valued. You’ll play a key role in shaping the future of cross-border finance, while advancing your own career in a dynamic, high-growth industry.

Senior Security Engineer


London Office - Hybrid: 4 days in the office, 1 day working from home


Role Overview

We are seeking a Senior Security Engineer to embed security throughout our product development lifecycle. You'll work directly with engineering teams to identify and mitigate security risks through threat modeling, secure code reviews, and integrated security tooling across our web and mobile applications. This role is critical to establishing our secure development practices, implementing industry-standard SSDLC processes, and ensuring our financial products are resilient against evolving threats.

Key Responsibilities

Secure Development Lifecycle (SDLC) Implementation

Design and implement secure software development practices


Integrate security gates into CI/CD pipelines following DevSecOps principles
Establish security quality gates and acceptance criteria
Develop secure coding standards based on OWASP guidelines
Create security architecture patterns and reference implementations

Security Code Reviews & Testing

Conduct in-depth security code reviews for critical features


Implement automated security testing (SAST, DAST, IAST, SCA)
Configure and tune security scanning tools (Aquasec, Trivy, Dependabot, etc)
Review cryptographic implementations against industry standards
Validate authentication and authorization implementations
Ensure compliance with OWASP ASVS (Application Security Verification Standard)

Threat Modeling & Risk Assessment

Lead threat modeling sessions using STRIDE, PASTA, or similar frameworks


Create threat models for new products and architectural changes
Identify attack vectors specific to web and mobile platforms
Develop abuse cases and security test scenarios
Maintain threat intelligence for fintech-specific risks
Document security requirements derived from threat models

Platform-Specific Security

Web Applications: Implement defenses against OWASP Top 10 vulnerabilities


Mobile Applications: Apply OWASP MASVS and platform-specific guidelines (iOS App Transport Security, Android Network Security Config)
APIs: Implement API security best practices (rate limiting, authentication, input validation)
Cross-platform session management and secure data storage

Security Tooling & Automation

Build and maintain security testing pipelines


Integrate security tools with GitHub Actions
Develop custom security linters and pre-commit hooks
Create automated vulnerability tracking and remediation workflows
Implement secret scanning and dependency checking
Build security dashboards and metrics reporting

Developer Enablement & Training

Create secure coding guidelines for different technology stacks


Develop a security champions program aligned with OWASP SAMM
Conduct security training on platform-specific vulnerabilities
Provide hands-on guidance during security incidents
Build internal security libraries and frameworks
Create threat modeling templates and playbooks

Required Qualifications

Technical Expertise

5+ years of application security experience


Strong programming skills in multiple languages (Python, JavaScript/TypeScript, Golang)
Deep understanding of security vulnerabilities across web and mobile platforms
Hands-on experience with security testing tools and methodologies
Expertise in secure coding practices and design patterns
Experience with modern development frameworks (React, Angular, ReactNative, Flutter)

Security Domain Knowledge

Expert knowledge of OWASP standards (Top 10, ASVS, SAMM, MASVS)


Understanding of cryptographic principles and secure implementations
Experience with threat modeling methodologies
Knowledge of authentication standards (OAuth2, OIDC, WebAuthn)
Familiarity with PCI-DSS, PSD2, and Strong Customer Authentication requirements
Understanding of cloud-native security patterns

Code Review & Analysis Skills

Ability to identify security vulnerabilities through manual code review


Experience with static and dynamic analysis tools
Understanding of common vulnerability patterns across languages
Knowledge of secure architecture patterns and anti-patterns
Ability to provide actionable remediation guidance

Professional Requirements

Experience in financial services or high-security environments


Strong communication skills to explain security risks to developers
Ability to balance security requirements with development velocity
Collaborative approach to working with engineering teams
Technical writing skills for documentation and guidelines

Preferred Qualifications

Experience with payment systems and transaction security


Knowledge of mobile app protection
Experience building security champions programs
Background in penetration testing or security research

Key Projects & Initiatives

You'll lead critical security initiatives, including:

Building threat modeling practice for all products


Establishing automated security testing in CI/CD pipelines
Creating platform-specific security standards and libraries
Developing a security training curriculum for + developers

What We Offer

Direct impact on the security of products used by thousands of businesses


Work with cutting-edge fintech products across multiple platforms
Collaborate with talented engineers across 25+ countries
Modern security tooling and testing infrastructure
Investment in professional development and certifications
Clear progression path to Staff/Principal roles

#LI-AT1
#HYBRID

Related Jobs

View all jobs

Senior Security Engineer

Senior Security Engineer (PurView, Sentinel, Defender)

Senior Security Engineer

Senior Security Engineer

Senior Security Engineer (Product Security)

Senior Security Engineer – London - £55,000

Subscribe to Future Tech Insights for the latest jobs & insights, direct to your inbox.

By subscribing, you agree to our privacy policy and terms of service.

Industry Insights

Discover insightful articles, industry insights, expert tips, and curated resources.

The Future of Cybersecurity Jobs: Careers That Don’t Exist Yet

Cyber security has become one of the most critical issues of our age. Once regarded as a technical problem confined to IT departments, it is now a board-level priority, a government mandate, and a daily necessity for individuals. The shift towards cloud services, remote working, connected devices, and artificial intelligence has dramatically increased the risks of digital attacks. In the UK, cyber security is central to national resilience. The government has identified cyber as a “tier one” threat to national security, alongside terrorism and pandemics. The private sector, from banks to retailers, now sees data breaches and ransomware as existential risks. Global spending on cyber security is projected to exceed $250 billion by 2030, with the UK already home to a thriving cyber industry employing tens of thousands. Yet, as powerful as the industry already is, we are only at the beginning. The technologies shaping the next two decades—AI, quantum computing, edge computing, extended reality, and biotechnology—will radically reshape cyber security. Many of the most vital cyber security jobs of the future don’t exist yet. This article explores why new roles will emerge, the careers likely to appear, how today’s jobs will evolve, why the UK is well-positioned, and how professionals can prepare now.

Seasonal Hiring Peaks for Cybersecurity Jobs: The Best Months to Apply & Why

The UK's cybersecurity sector has emerged as one of the most critical and lucrative technology markets, with roles spanning from security analysts to penetration testers and chief information security officers. With cybersecurity positions commanding salaries from £28,000 for junior security analysts to £140,000+ for senior security architects, understanding when organisations actively recruit can dramatically impact your career trajectory in this essential field. Unlike traditional IT sectors, cybersecurity hiring follows distinct patterns influenced by threat landscapes, regulatory compliance cycles, and incident response requirements. The sector's unique combination of perpetual threat evolution, regulatory pressures, and skills shortages creates predictable hiring windows that strategic professionals can leverage to advance their careers in protecting Britain's digital infrastructure. This comprehensive guide explores the optimal timing for cybersecurity job applications in the UK, examining how cyber threat cycles, compliance deadlines, and government initiatives influence recruitment patterns, and why strategic timing can determine whether you join a cutting-edge security consultancy or miss the opportunity to defend against tomorrow's cyber threats.

Pre-Employment Checks for Cyber Security Jobs: DBS, References & Right-to-Work and more Explained

The cyber security sector in the UK stands at the forefront of protecting national infrastructure, business operations, and personal data from increasingly sophisticated cyber threats. As organisations across all sectors recognise cyber security as a critical business function, employers are implementing the most rigorous pre-employment screening processes in the technology industry to ensure they recruit professionals capable of defending against advanced persistent threats and maintaining the highest standards of security and trustworthiness. Whether you're a penetration tester, security analyst, incident response specialist, or chief information security officer, understanding the comprehensive vetting requirements is essential for successfully advancing your career in this security-critical field. This detailed guide explores the extensive background checks and screening processes you'll encounter when applying for cyber security positions in the UK, from fundamental eligibility verification to the most stringent security clearance requirements and specialised threat intelligence assessments.