Founding Infrastructure & Security Engineer Infrastructure · London (Paddington), hybrid Read

Seisa; Greater London; Hybrid; GBP 90,000 - 150,000; Full time

Job summary

Seisa in London is seeking a security-focused platform owner to own the GCP stack, IAM, and evidence for SOC 2 and ISO 27001. You will implement IaC, manage Terraform, backups, and access controls, and coordinate audits with external firms.

You will work with Python and CI pipelines, maintain production readiness, and respond to incidents in a small team. The role centers on engineering controls, not governance writing, with a practical, hands-on mindset.

Qualifications

• Experience running production infrastructure on major cloud (GCP preferred).
• Led SOC 2 or ISO 27001 audits and owned controls with evidence.

Responsibilities

• Manage the GCP platform components (Cloud Run, Cloud Tasks, Pub/Sub, Vertex AI, Secret Manager, KMS, Cloud Storage, Cloud Build) via Terraform.
• Maintain Neo4j and Postgres on Supabase; ensure backups and isolation between firms.
• Keep staging and production fully separate with clean promotions.
• Enforce least-privilege IAM, SSO and MFA; perform access reviews and secret rotation.
• Safely manage connectors like Microsoft 365 and token scopes.
• Coordinate SOC 2/ISO 27001 controls in Vanta; liaise with auditor and pen-test firm.
• Develop the security pack and questionnaires; support security calls with CTOs.
• Provide observability and incident response suitable for a small team.

Skills

GCP production infra

SOC 2 audit

Python programming

CI pipelines

Infrastructure as code

Terraform

Access management

Tools

Terraform

Vanta

Microsoft 365

Job description

Every firm we work with checks how we handle its data before it lets us near it. Today the engineers who build the product also run the infrastructure and answer the security questions. You would own the platform and the controls behind those answers, as the first person whose whole job is this.

Why this role, why now

Seisa holds a firm’s most confidential material: deal memos, data rooms, partner email. What we tell a firm’s security team has to be true and backed by evidence, and this is the role that makes it so. It is the seat we most need to fill.

What you will do

The GCP platform

Cloud Run, Cloud Tasks and Pub/Sub, Vertex AI, Secret Manager and KMS, Cloud Storage and Cloud Build, brought under Terraform.

Neo4j, Postgres on Supabase and Langfuse: backups, restore drills, and isolation between firms.

Staging and production fully separate, and promotion from one to the other uneventful.

Identity and access

Least-privilege IAM, SSO and MFA everywhere, access reviews, secret rotation and offboarding.

Connectors

Microsoft 365 and the other sources we read handling tokens, scopes and permissions safely.

Compliance

The controls behind our SOC 2 and ISO 27001 work in Vanta, with the auditor and pen-test firm you choose and manage.

Security answers

The security pack, the questionnaires firms send, and the calls where their CTO wants to talk to someone technical.

Observability and incidents

Monitoring and incident response that fit a small team.

What we look for

• You have run production infrastructure on a major cloud, GCP ideally, Azure or AWS welcome, and written the infrastructure as code for it.
• You have been the person who got a SOC 2 or ISO 27001 audit through at a startup or scale-up, and can name the controls you owned and the evidence you produced.
• You are comfortable in Python and a CI pipeline, and will read and change application code, not only configuration.
• You would rather answer “Partial” with a plan than tick “Yes” on something that is not true.
• Probably five to twelve years in, though we care about what you have owned more than the number.

Nice to have: Neo4j or Postgres operations, Entra ID and Microsoft Graph, multi-tenant SaaS, a GCP or Azure security certification.

What it is not

Not a compliance‑writing role: Vanta handles most of the paperwork, and the gap is engineering. Not round‑clock on‑call for a large estate, and not a security operations centre. Pen tests and audit sign‑off are bought in; you choose and manage them.

The first 90 days, roughly

• 01 Terraform for the GCP estate, IAM and secrets cleaned up, and staging and production fully separate.
• 02 Technical controls green in Vanta, and a pen test booked.
• 03 A security pack we can send the same week a firm asks for it.

Stack

GCP, Neo4j, Postgres on Supabase, Langfuse, Python, Vanta.

How we hire

• 01

  Intro

  30 minutes, a call

  What you have built, what you want next, and what Seisa is.

• 02

  Technical

  1 hour, in Paddington

  A review of the access setup on a slice of our real platform, and how you would answer a firm’s security questionnaire.

• 03

  Half-day build

  With the team

  Half a day working with the team on a real piece of the platform.