Security Engineer, AI SaaS — SOC 2 & Incident Response

Crimson; Greater London; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Competitive salary

Meaningful equity

Job summary

Crimson is hiring a security leader/engineer to own the continued evolution of our security programme. You will work closely with the founders and engineering team to ensure our security posture keeps pace with rapid product development and enterprise adoption.

Based in London or New York, this full-time role requires hands-on security across cloud, application and data, with direct engagement in threat modelling, incident response and customer security reviews. Equity is offered.

Qualifications

• Strong hands-on experience securing a modern cloud-hosted SaaS product.
• Grounding in application security, cloud security, identity and incident response.
• Ability to review code and architecture, automate controls with engineers.
• Clear communication with technical teams and security stakeholders.

Responsibilities

• Own and evolve Crimson's security roadmap across app, cloud, data, and identity.
• Partner with engineers on threat modelling, architecture reviews and secure design.
• Operate and automate vulnerability management, secrets management, and access controls.
• Maintain incident response program, run playbooks and investigations.
• Coordinate penetration tests and represent security posture in customer reviews.
• Maintain SOC 2 Type II attestation evidence and compliance controls.
• Embed practical security tooling into a fast-moving engineering culture.

Skills

Cloud security

Application security

Incident response

Threat modelling

Code review

Security automation

Tools

AWS

GCP

Azure

CI/CD security tooling

Job description

Crimson is hiring a security leader/engineer to own the continued evolution of our security programme. You will work closely with the founders and engineering team to ensure our security posture keeps pace with rapid product development and enterprise adoption.

Based in London or New York, this full-time role requires hands-on security across cloud, application and data, with direct engagement in threat modelling, incident response and customer security reviews. Equity is offered.