Software Security Engineer

Department: Tech - Security

Employment Type: Permanent - Full Time

Location: Oxford, UK

Reporting To: Head of Information Security

Description

Key Responsibilities

• Cultivate security culture. Work with product and engineering colleagues, be the security champion that strives to prioritize sustainable controls and drives real risk reduction outcomes.
• Build secure products. Ensure security is considered throughout the product and software development life cycle. Provide security best practice, build security design patterns, complete security architecture reviews, threat models and risk assessments. Help solve engineering problems by implementing technical controls to mitigate risk.
• Ensure we are deploying solutions into a secure environment. Ensure we build solutions in alignment with our control requirements. Support on-going business-as-usual and champion vulnerability management. Provide internal security consultancy and lead on audit engagements, risk activities and project initiatives. Work closely with colleagues to ensure effective technology risk management.
• Work together. Collaborate and work with product and engineering teams. Help to solve problems and not just calling out issues. Take ownership of operational duties. Operate across the business to create alignment with security objectives.
• Ensure security thought leadership. Keep up on security best practice and be a continuous learner. Guide and define our security policies, procedures, and standards end-to-end, be recognized as a point of escalation and subject matter expert for software and data risk.

What we are looking for

• Degree in a computer science related subject or comparable working experience related to the role.
• Working knowledge of best-practices for securing micro-service architectures.
• Working knowledge of modern secure SDLC practices with a focus on embedding security into CI/CD pipelines.
• Working experience of the above concepts in the context of at least one major public cloud provider (AWS, GCP, or Azure).
• Understanding of global security standards (like SOC2 or ISO 27001) and regulatory requirements and experience in maintaining compliance with these.
• A desire to teach others and share knowledge. We want you to coach other team members on secure coding practices, design principles, and implementation patterns.
• Comfortable in uncharted waters. We are building something new. Things change quickly. We need you to learn technologies and patterns quickly.
• Ability to see the long term. We don’t want you to sacrifice the future for the present.
• Clarity of thought. We operate quickly and efficiently, and we value people who are economical with their time and clear with their opinions.

• Experience in a software engineering role, ideally with focus on security.
• Working knowledge of offensive security, Application and Infrastructure penetration testing (OWASP top 10, OWASP ASVS).
• Understanding of security vulnerabilities and remediation options in codebases & containers.
• Working knowledge of methods for authentication and authorization (ODIC, OAuth 2, FIDO 2, etc)

What we offer

• Private Medical Insurance
• Dental Insurance
• Parental Support
• Salary-Exchange Pension
• Employee Assistance Programme (EAP)
• Local Oxford Discounts
• Cycle-to-work Scheme
• Flu Jabs