Security and Compliance Engineer

Griffin; Greater London; Hybrid; GBP 80,000 - 110,000; Full time

Job summary

Griffin, a fully regulated UK bank, seeks an Engineer 1.5 to own security controls across engineering, security, risk and resilience. You will convert standards into practical controls, ship code, and build confidence across second and third lines.

Reporting to Engineering leadership, you’ll collaborate with CTO and Founder Allen Rohner and drive ISO 27001, SWIFT, and SOC 2 initiatives while strengthening Griffin’s security posture.

Qualifications

• Translate standards into practical engineering controls.

Responsibilities

• Own control design and cyber security governance, translating standards into practical engineering controls.
• Lead certifications and attestations (SWIFT, FPS, SOC 2, ISO 27001).
• Own internal and external audits and customer due diligence requests with timely closure.
• Conduct Engineering Risk and Controls Self Assessments and recurring control activities.
• Improve code release and change management processes and sampling of releases.
• Lead post-incident reviews and share learnings with stakeholders.
• Contribute to operational resilience (DR plans) and manage engineering third parties.

Skills

Cyber security governance

Security controls engineering

Audits & attestations

Code release & change management

Incident post-mortems & learning

Tools

SWIFT

FPS

SOC 2

ISO 27001

Job description

About Griffin

Hi, we're Griffin. We're a fully regulated UK bank that powers the accounts and payments offerings of product-led fintechs and platforms like Uber, Yonder, Prosper, and Sidekick. By doing the heavy lifting behind the scenes, our customers can focus on what they do best - delivering amazing customer experiences.

We've grown rapidly since our launch in 2024, and today provide the banking backbone behind products in remittance, payroll, wealth, insurance, proptech, payments, neobanking and more.

We're moving into card issuing, stablecoin infrastructure, and agentic finance next as we continue to support the next generation of product-led companies.

Learn more about what we do

Our culture

We believe that smart, motivated, conscientious people thrive in high-trust, high-autonomy environments and have done our best to create such an environment at Griffin. People who thrive here don't require much hand-holding, and go out of their way to figure out how to contribute in the most valuable way possible.

We've been remote-first since we were established in 2017 and we remain so today. Work here is asynchronous and fully flexible - because we want to be a part of your life in a way that helps you to get the most out of both your work and home life.

We understand that our culture and ways of working aren't for everyone, and we're very intentional about our hiring process as a result. We won't hire people who don't seem like a strong fit for our core values, even if they're otherwise extremely qualified.

Our strong culture has helped us to remain a mission-driven company as we have scaled, and gives our people a clear, explicit operating framework and the space to focus on delivering real value for our customers.

Learn more about our culture.

The Team

The Craft function has seven small, cross-functional engineering teams - each with engineers, an engineering manager, and a product manager, working closely with designers.

You will work across the whole Craft function, with the remit of improving our controls and cyber security governance. You will initially work with and report to the Engineering Manager for Infrastructure as you establish yourself and take on your day to day responsibilities, additionally you will work closely with our CTO and Founder, Allen Rohner.

The Opportunity

We're looking for an Engineer 1.5 to become the engineering voice of security, compliance and assurance at Griffin. Sitting across engineering, security, risk and operational resilience, you'll turn standards and regulatory expectations into practical controls that engineers actually want to use and you'll build those controls yourself, shipping code to production alongside the engineering team. You'll also give our second and third lines real confidence in what we've built. It's a rare hybrid role with broad ownership and a direct hand in strengthening Griffin's security.

What Success Looks Like

In your first 6 months, you'll have taken ownership of our certification, attestation and audit work including ISO 27001 and SWIFT, with evidence organised and findings driven through to closure. Our engineering risks and controls will be well maintained, and our release, change and post-incident processes will be stronger. You'll have shipped code that automates control checks and evidence collection, and you'll be a regular contributor to our codebase.

By month 12 our resilience plans, including Important Business Service technical mapping, B& Continuity Planning and disaster recovery, will be current, and security and compliance will be easier to run and easier to demonstrate to customers, thanks to clearer ownership and smart automation.

To Do This You'll Own

• Control design and cyber security governance: translating standards into practical engineering controls and building and shipping the code that puts them in place, working with Engineering teams to get them live
• Certifications and attestations, from SWIFT and FPS today to schemes like SOC 2 and ISO 27001 in the future, including the documentation behind them
• Internal and external audits and customer due diligence requests, owning findings and driving them to closure
• Engineering Risk and Controls Self Assessments, controls and actions, plus recurring control activity such as chaos testing and backup/restore
• Code release and change management, improving the process and sampling releases to check adherence to policy
• Post-incident reviews, including follow-up actions and sharing learnings with the right stakeholders
• Engineering's contribution to operational resilience (DR plans and IBS technical mapping) and to managing engineering third parties alongside Operations

We expect you to shape this role

This description reflects what we need today. How you achieve these outcomes, where you focus your energy, how this role evolves-that's for you to define as you learn what our customers need and where our technical gaps are.