Lead Edge Platform Security Engineer
GLORY
Get a reply from this employer
Your resume and cover letter, tailored to exactly what they’re hiring for.
Job summary
OneBanx is seeking a Lead Edge Platform Security Engineer to own the kiosk network, secure pipelines and drive security across cloud infrastructure. You will work on OpenWrt/pfSense devices, build reusable GitLab CI/CD pipelines, and lead penetration testing and vulnerability management.
The role combines networking, DevOps enablement and security leadership, reporting to the CTO. Permanent, full-time, UK/Basingstoke location.
Qualifications
- Hands-on experience with OpenWrt and pfSense on real hardware.
- Experience building secure GitLab CI/CD pipelines and Terraform modules.
- Strong networking fundamentals and security best practices.
Responsibilities
- Own edge networking for kiosks including device identity and secure connectivity.
- Build reusable GitLab CI/CD templates and Terraform modules with security in mind.
- Drive security improvements: penetration testing, patching cadence, and supplier security.
Skills
Education
Tools
Job description
Lead Edge Platform Security Engineer
Application Deadline: 2 November 2026
Department: Product Mgmt - Product Promotion
Employment Type: Permanent - Full Time
Location: UK/Basingstoke
Reporting To: CTO Onebanx
Description
OneBanx
OneBanx builds and runs a fintech platform that powers self-service banking kiosks. We are looking for an experienced engineer who combines DevSecOps (development, security and operations) skills with a real passion for networking and network devices. The role brings together three areas of equal importance.
Edge networking: you will own and improve the network that connects our kiosks, built on OpenWrt and pfSense devices deployed in the field and managed remotely as a fleet. This calls for hands-on experience with network devices and a strong interest in how they behave in real-world conditions.
DevOps enablement: our engineers already run much of their own infrastructure, so this is not about owning everything; you will set best practice, build the reusable GitLab pipeline and Terraform templates the team relies on, and support them where they need specialist help.
Security: you will drive most of our security work, from annual penetration test to pushing hardware suppliers to a higher security standard.
- Own the kiosk network end to end, from on-site devices through to the secure connection back to our platform
- Maintain and improve OpenWrt and pfSense configurations, firmware and upgrade processes across a remote fleet
- Act as the escalation point for connectivity issues and turn recurring problems into permanent fixes
- Lead the evolution of how devices connect and authenticate, moving towards a modern model where each device proves its identity and requests only the access it needs
- Keep site build standards and runbooks up to date so kiosks can be deployed and supported reliably
- Build and maintain reusable GitLab CI/CD (continuous integration and delivery) pipeline templates, with security scanning built in
- Create Terraform best-practice templates and modules that the team can adopt for their own infrastructure
- Coach engineers on infrastructure-as-code, secrets handling and secure pipeline design, rather than doing it for them
- Support the team on infrastructure work outside their day-to-day expertise, and document it so it is repeatable
- Look after our self-managed GitLab instance, including routine upgrades
- Contribute to architecture decisions and write them up so the wider team understands the reasoning
- Drive our security improvement work, reporting to the CTO
- Own the annual penetration test: scoping, managing the testing firm, triaging findings and tracking fixes to closure
- Maintain a security improvement backlog across cloud infrastructure, developer tooling and the kiosk estate
- Push our hardware and firmware suppliers to improve their security: assessments, patch commitments and contractual requirements
- Set the patching and vulnerability management cadence for infrastructure and network devices
- Own certificate, key and credential lifecycles, including rotation
- Support audits and customer security due diligence with clear evidence and documentation
A flavour of the problems this role will tackle:
- Edge Network: OpenWrt and pfSense devices deployed in the field and managed remotely as a fleet
- Device Identity: Moving towards a model where devices enrol, authenticate and request access securely
- Platform Templates: Shared GitLab CI/CD and Terraform templates that make the secure way the easy way for every team
- Secure Pipelines: Security scanning and secrets handling built into how every team ships
- Penetration Testing: Running the annual test and making sure findings are fixed, not just filed
- Supplier Security: Working with hardware and firmware suppliers to raise their security standards
Education Level:
BSc Computer Science, IT or software engineering related qualification (desirable)
We do not expect one person to be an expert in everything below; we do expect hands-on experience in each area, and real depth in at least one.
- OpenWrt
- pfSense
- WireGuard / OpenVPN
- GitLab CI/CD
- Terraform
- AWS
- Linux / Shell / Python
- Secrets & Certificate Mgmt
- Penetration Testing
- Vulnerability Management
- Supplier Security
- Network Security
- Hands-on experience with OpenWrt and pfSense (or OPNsense) on real hardware
- VPN technologies such as WireGuard and OpenVPN: configuration, key management and troubleshooting
- Strong TCP/IP fundamentals: subnetting, routing, DNS, DHCP, VLANs and firewall design
- Experience managing remote devices where a mistake can mean a site visit
- Writing and maintaining GitLab CI/CD pipelines, ideally including shared templates used across many projects
- Terraform: modules, remote state, state locking and safe plan/apply workflows
- Working knowledge of AWS, particularly networking and IAM (identity and access management)
- Comfortable in Linux and with scripting in shell and/or Python; familiar with administering self-hosted tools such as GitLab
- Practical involvement in penetration testing: scoping, remediation planning and re-testing
- Vulnerability management: reading advisories, scoring severity and prioritising patches
- Secrets and certificate management in production environments
- Confidence working with third parties to agree and track security improvements
The following are not required but will distinguish exceptional candidates:
- Fleet management tooling for routers or other network devices
- IoT (Internet of Things) device identity and enrolment: device certificates, zero-touch provisioning, mutual TLS
- Cellular (4G/LTE) connectivity on Linux-based devices
- Container platforms and image security scanning
- Policy-as-code or automated compliance checks in pipelines
- Centralised logging and monitoring for both cloud and remote devices
- Experience in fintech, payments or another regulated environment
- Supplier security assessment and third-party risk management
- Security certifications such as OSCP, CompTIA Security+ or CISSP (helpful, not essential)
Beyond technical credentials, we value engineers who embody the following:
- Passion for networks and devices: you enjoy the hands-on side as much as the automation
- Enabler, not gatekeeper: you raise the team's capability rather than becoming a bottleneck
- Self-driven: you take the initiative on security and see improvements through without being chased
- Ownership mentality: you see problems through to a permanent fix
- Careful with change: you plan rollouts and rollbacks, whether for pipelines or for devices in the field
- Firm but constructive with suppliers: comfortable pushing vendors to meet the standard we need
- Clear communicator: able to explain risks and decisions to engineers and non-technical stakeholders alike
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
