Security Engineer

ALDERGROVE HOUSE LIMITED; United Kingdom; Remote; GBP 60,000 - 100,000; Part time

Job summary

ALDERGROVE HOUSE LIMITED in the United Kingdom is seeking a senior security engineer to read our code, audit infrastructure, and prepare fixes. The role fits remote work in UK time zones and could be 2–3 days per week.

You will join a small practice focusing on data and payment stacks, with light governance and rapid incident post-mortems.

If you enjoy hands-on threat modelling and cross-stack reviews, this is a chance to influence security early in the lifecycle.

Qualifications

• 5+ years in application security or security engineering.
• Familiar with UK data law: UK GDPR, PCI-DSS as far as it reaches a small practice.
• Hands-on with at least two languages we ship (reading production code).
• Comfort with threat modelling early in system design.

Responsibilities

• Pre-release code reads across the stack — Next.js (TypeScript), Frappe (Python), Phoenix (Elixir), occasional Rust/C++.
• Infrastructure audits: secrets management, access reviews, network segmentation, dependency SBOMs.
• Incident response when something goes wrong; written post-mortems for the whole team to learn from.
• Threat modelling at the start of new systems — a seat at the table before the first commit.

Skills

Application security

Security engineering

OWASP knowledge

Code reading

Job description

We hold payment data, personal data, and the operating stacks of several small businesses. Keeping that quiet is the work. This role reads what we ship, finds the ways in, and writes the fixes. What you’d do…

We hold payment data, personal data, and the operating stacks of several small businesses. Keeping that quiet is the work. This role reads what we ship, finds the ways in, and writes the fixes.

What you’d do

• Pre-release code reads across the stack — Next.js (TypeScript), Frappe (Python), Phoenix (Elixir), occasional Rust/C++
• Infrastructure audits: secrets management, access reviews, network segmentation, dependency SBOMs
• Incident response when something goes wrong; written post-mortems the whole team can learn from
• Threat modelling at the start of new systems — a seat at the table before the first commit

What we’d expect

• 5+ years in application security or security engineering
• OWASP comfort: auth, sessions, secrets, injection, SSRF, CSRF, deserialisation — the full ten
• Hands‑on with at least two of the languages we ship (reading production code at speed)
• Familiar with UK data law: UK GDPR, PCI‑DSS as far as it reaches a small practice

Nice to have

• Published CVEs, bug bounty track record, or security‑focused OSS work
• ISO 27001 / SOC 2 experience from a company that actually passed audit
• Hardware or firmware security exposure (we occasionally touch embedded clients)

How we work

• Remote, UK time zones; part‑time (2–3 days/week) is viable for the right senior candidate
• Written reports preferred over shouted alerts

Duration

Your own time

Stage 1 of 6

II

The first reading

Every application is read by a partner, not screened out by a filter.

A partner reads what you sent. You hear back within five working days — either an invitation to speak, an honest refusal with a short reason, or an ask for a specific thing we need to decide.

Duration

Within one week

Stage 2 of 6

III

The conversation

A proper meeting, not a screening call.

Two partners, you, a shared agenda sent twenty‑four hours in advance. We talk about the work you have done, how we would work together, and the questions you have brought with you.

Duration

Thirty minutes, by video

Stage 3 of 6

IV

A short piece of work

Role‑dependent. If it looks like work, we pay for it.

For technical and craft roles, a short brief returned in your own time. The brief is representative of what the house actually does — no synthetic puzzles. If the task reads as commercial‑length work, we pay you a day rate for the time.

Duration

Two to four hours · paid when commercial‑length

Stage 4 of 6

V

The final sitting

You meet all three readers of the house.

The three partners who run the practice sit with you. The decision is usually made in the room; where it is not, we tell you when to expect a reply.

Duration

Sixty minutes · video or in Cambridge

Stage 5 of 6

VI

The offer, in writing

Written terms, standard form, countersigned.

A short offer letter — role, start date, salary, holiday, notice. Signed by both sides. First day is usually within three weeks.

Duration

The same week

Stage 6 of 6

When you are ready