Lead Edge Platform Security Engineer

This is a fully remote position, open to applicants in United Kingdom.

📋 Description

• Take ownership of and enhance the edge network that connects self-service banking kiosks, ensuring secure connections from field devices to the platform.

• Oversee and enhance OpenWrt and pfSense configurations, firmware, and upgrade procedures across a fleet of remote devices.

• Address connectivity issues and transform recurring problems into lasting solutions.

• Lead advancements in device identity, secure authentication, and least-privilege access principles.

• Uphold kiosk deployment standards and assist with runbook maintenance.

• Develop and sustain reusable GitLab CI/CD pipeline templates that include security scanning.

• Create best-practice templates and modules for Terraform.

• Mentor engineers on infrastructure-as-code, managing secrets, and designing secure pipelines.

• Provide infrastructure support beyond the team's usual expertise and document repeatable solutions.

• Manage the self-hosted GitLab instance, including regular upgrades.

• Participate in architecture decisions and document the reasoning behind them.

• Champion security enhancement initiatives while reporting to the CTO.

• Oversee the annual penetration test, including scoping, managing the testing firm, triaging findings, and tracking remediation efforts.

• Maintain a backlog of security improvement tasks across cloud infrastructure, developer tools, and the kiosk environment.

• Enhance security of hardware and firmware suppliers through assessments, patch commitments, and contractual obligations.

• Establish a cadence for patching and vulnerability management for both infrastructure and network devices.

• Manage the lifecycle of certificates, keys, and credentials, including their rotation.

• Assist during audits and customer security due diligence with appropriate evidence and documentation.

⛳️ Requirements

• A BSc in Computer Science, IT, or a related software engineering field is preferred but not mandatory.

• Practical experience with OpenWrt and pfSense or OPNsense on physical hardware.

• Proficient in configuring, managing keys for, and troubleshooting WireGuard and OpenVPN.

• Strong understanding of TCP/IP fundamentals, including subnetting, routing, DNS, DHCP, VLANs, and firewall architecture.

• Experience managing remote devices, where errors may necessitate a site visit.

• Familiarity with writing and maintaining GitLab CI/CD pipelines, preferably using shared templates.

• Knowledge of Terraform modules, remote state management, state locking, and secure plan/apply practices.

• Working knowledge of AWS, especially in networking and IAM.

• Comfortable with Linux and proficient in shell scripting and/or Python.

• Experience administering self-hosted tools, such as GitLab.

• Hands-on experience in penetration testing, encompassing scoping, remediation planning, and re-testing.

• Background in vulnerability management, including interpreting advisories, assessing severity, and prioritizing patches.

• Experience with managing production secrets and certificates.

• Ability to collaborate with third parties to establish and monitor security improvements.

• Desirable experience in fleet management tools, IoT device identity and enrollment, cellular 4G/LTE connectivity, container platforms, image security scanning, policy-as-code, automated compliance checks, centralized logging and monitoring, fintech/payments or regulated environments, and supplier security assessments.

• Security certifications such as OSCP, CompTIA Security+, or CISSP are advantageous but not essential.

🏝️ Benefits

• Competitive salary and performance-based incentives.

• Opportunities for professional development and career advancement.

• Flexible working hours and a supportive work environment.

• Health and wellness programs to promote work-life balance.

• Access to the latest technologies and tools in the industry.