Security Engineer - Engine by Starling

At Engine by Starling, we are on a mission to find and work with leading banks all around the world who have the ambition to build rapid growth businesses, on our technology. 

Engine is Starling's software-as-a-service (SaaS) business, the technology that was built to power Starling Bank, and a year ago we split out as a separate business. 

Starling Bank has seen exceptional growth and success, and a large part of that is down to the fact that we have built our own modern technology from the ground up. This SaaS technology platform is now available to banks and financial institutions all around the world, enabling them to benefit from the innovative digital features, and efficient back-office processes that has helped achieve Starling's success.

We draw upon our experience as knowledgeable bankers, and best in class technologists to become the chosen option for these banks, and preferred partners for leading consultancies.

As a company, everyone is expected to roll up their sleeves to help deliver great outcomes for our clients. We are an engineering led company and we’re looking for someone who will be excited by the potential for Engine’s technology to transform banking in different markets around the world.

Hybrid Working

We have a Hybrid approach to working here at Engine - our preference is that you're located within a commutable distance of one of our offices so that we're able to interact and collaborate in person. We don't like to mandate how much you visit the office and work from home, that's to be agreed upon between you and your manager. 

About Engineering at Engine by Starling - https://www.enginebystarling.com/ 

As a Security Engineer at Engine, you’ll be working on helping to keep our infrastructure secure and compliant and our staff safe and productive.

You’ll be working on projects covering identity and access management, endpoint security, office infrastructure, data loss prevention, security hardening, compliance reviews, and more.  It’s a very varied role with lots of close interaction with the infrastructure, security engineering, cross cutting and compliance teams.

Engine by Starling engineers are excited about helping us deliver new features, regardless of what their primary tech stack may be. Hear from the team in our latest Blog or our case studies with Women in Tech.

We are looking for an experienced Senior/Staff level Security Engineer to join our growing Security Engineering team, working closely with the GRC & compliance team and the various Engine Technology teams to make sure security is at the heart of all our technical processes.  Your place within the team will depend on your individual strengths and interests.

This role will cover a wide array of security areas across our SaaS cloud environments, as well as corporate domains & internal infrastructure and will require a skilled individual to spearhead efforts in fortifying both infrastructure and application platforms, against potential threats.

What you’ll get to do?

• Collaborate with stakeholders to define our Google Cloud security architecture (Cloud identity, runtime security, security posture)
• Create security tooling to enhance our specific security landscape
• Be part of the team responsible for safeguarding our systems, applications, and data by ensuring secure user access, authentication, and authorisation mechanisms are in place
• Help us to stay nimble by building compliance and security control automations
• Drive security infrastructure deployments across our growing environments

• Perform regular security assessments, audits and architecture design reviews to identify risks and vulnerabilities, triage found risks appropriately and improvements then design controls to implement as corrective actions
• Lead incident response efforts, including investigation and remediation of security breaches
• Support our internal security awareness and training programs and advocating the DevSecOps mindset that we have created across our technology teams

Requirements

What skills are essential:

• You have an in-depth knowledge of security principles, technologies, and best practices, threat detection and mitigation strategies
• Mature understanding and experience with cloud security architecture (AWS, Google Cloud) with a proven track record
• Excellent problem-solving, communication and active listening skills with an innate passion for security
• A proactive approach to staying updated with the latest security threats, vulnerabilities, and mitigation techniques
• Strong programming skills, in security we write our own scripts for automation in Python, Go and other languages while contributing to open-source tools so we can utilise them 

What skills are desirable:

• Hands on experience taking your company through security and compliance frameworks like NIST, SOC2, ISO270001, PCI-DSS
• Experience with Infrastructure as Code and infrastructure provisioning tools (Cloudformation, Terraform)
• Expertise in Kubernetes, securing clusters and meshes (Cilium is preferable), networking best practices and RBAC implementation (CKA, CKS qualifications are a plus)
• Container security knowledge including container image provenance (e.g. Sigstore, Notary) with an in-depth knowledge of container runtimes
• Strong understanding of network protocols & practices, firewalls, intrusion detection/prevention systems and WAFs
• Experience securing code reviews and security approvals
• Experience in Cryptography management & enhancements
• Relevant security certifications such as ISC2 CC, CISSP, CCSP, CISM, AWS Security Specialist or GCP Professional Cloud Security Engineer 

Our Interview process

Interviewing is a two way process and we want you to have the time and opportunity to get to know us, as much as we are getting to know you! Our interviews are conversational and we want to get the best from you, so come with questions and be curious. In general you can expect the below, following a chat with one of our Talent Team:

• Initial interview with an Engineer - ~45 minutes
• Take home technical test to be discussed in the next interview
• Technical interview with some Engineers - ~1.5 hours
• Final interview with our CTO / deputy CTO ~45 minutes

Benefits

• 33 days holiday (including public holidays, which you can take when it works best for you)

• An extra day’s holiday for your birthday
• Annual leave is increased with length of service, and you can choose to buy or sell up to five extra days off
• 16 hours paid volunteering time a year
• Salary sacrifice, company enhanced pension scheme
• Life insurance at 4x your salary & group income protection
• Private Medical Insurance with VitalityHealth including mental health support and cancer care. Partner benefits include discounts with Waitrose, Mr&Mrs Smith and Peloton
• Generous family-friendly policies
• Incentives refer a friend scheme
• Perkbox membership giving access to retail discounts, a wellness platform for physical and mental health, and weekly free and boosted perks
• Access to initiatives like Cycle to Work, Salary Sacrificed Gym partnerships and Electric Vehicle (EV) leasing

You may be put off applying for a role because you don't tick every box. Forget that! While we can’t accommodate every flexible working request, we're always open to discussion. So, if you're excited about working with us, but aren’t sure if you're 100% there yet, get in touch anyway. We’re on a mission to radically reshape banking – and that starts with our brilliant team. Whatever came before, we’re proud to bring together people of all backgrounds and experiences who love working together to solve problems.

Engine by Starling is an equal opportunity employer, and we’re proud of our ongoing efforts to foster diversity & inclusion in the workplace. Individuals seeking employment at Engine by Starling are considered without regard to race, religion, national origin, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, medical condition, ancestry, physical or mental disability, military or veteran status, or any other characteristic protected by applicable law. 

When you provide us with this information, you are doing so at your own consent, with full knowledge that we will process this personal data in accordance with our Privacy Notice. By submitting your application, you agree that Engine by Starling and Starling Bank will collect your personal data for recruiting and related purposes. Our Privacy Notice explains what personal information we will process, where we will process your personal information, its purposes for processing your personal information, and the rights you can exercise over our use of your personal information.