Security and Compliance Engineer

This is a fully remote position, open to applicants in United Kingdom.

📋 Description

• Enhance controls and cyber security governance within the Craft function.

• Convert standards and regulatory expectations into effective engineering controls.

• Develop and deploy production code that incorporates security and compliance measures.

• Take responsibility for certifications and attestations, including SWIFT and FPS, and future frameworks such as SOC 2 and ISO 27001.

• Prepare and maintain documentation for certifications and audits.

• Oversee internal and external audits as well as customer due diligence inquiries.

• Ensure that audit findings and actions are resolved effectively.

• Manage Engineering Risk and Controls Self-Assessments.

• Oversee recurring control activities such as chaos testing and backup/restore operations.

• Enhance code release and change management processes while sampling releases for policy compliance.

• Perform post-incident reviews, manage follow-up actions, and disseminate insights.

• Support operational resilience through disaster recovery strategies and the technical mapping of Important Business Services.

• Assist in managing engineering third parties in collaboration with Operations.

• Work closely with Engineering teams, the CTO, the Founder, auditors, control functions, and other stakeholders.

• Initially report to the Engineering Manager for Infrastructure.

⛳️ Requirements

• A hands-on engineering or technical background.

• Proven experience in writing and deploying production code.

• An engineering-first mindset for translating standards into actionable controls and technical solutions.

• Experience in security, compliance, risk, or assurance within a technical setting.

• Experience in leading or significantly contributing to audits, certifications, or attestations.

• Strong understanding of compliance, risk, and cyber security principles.

• Comprehensive knowledge of change and release management, incident management, operational resilience, and third-party governance.

• Strong analytical and assurance capabilities.

• Proficient in stakeholder management and influencing across Engineering, subject matter experts, auditors, and control functions.

• Excellent writing skills with a focus on clarity and readability.

• Familiarity with SOC 2, ISO 27001, SWIFT, and FPS, preferably in a regulated fintech or challenger bank environment.

• Experience utilizing automation and code to enhance security, compliance, or control processes and documentation.

• The successful candidate must undergo background screening, including right-to-work verification, criminal record check, credit history review, social media assessment, and professional reference checks.

• Banking experience is required (application question).

🏝️ Benefits

• Remote-first flexibility: Work from any location within the UK.

• Work from abroad: Up to 20 days per year.

• Time off: 25 days of holiday, bank holidays, and a winter break (we close between Christmas and New Year).

• Share options: Own a part of what we’re building together.

• Pension: Automatic enrollment in our Penfold scheme.

• Insurance: Private medical coverage with Bupa (including family coverage) and life insurance with AIG.

• Wellbeing: Access to 1:1 coaching and therapy sessions through Oliva.

• Family leave: Enhanced parental leave, offering up to 6 months at full pay after two years of service.

• AI tools: Everyone receives a Claude subscription and access to other premium tools at no cost.

• Your setup: We will assist you in creating a comfortable and effective work-from-home environment.

• Fully flexible, asynchronous remote-first working model.

• A small London office is available for those who prefer it.