Security engineer in legal tech

Legatics; Greater London; Sur place; GBP 90 000 - 130 000; Plein temps

Avantages offerts par ce poste

25 days holiday

Early finish Fridays

Pension with NEST

Private Medical Insurance

Health voucher / Health Cash Plan

Learning & development budget

Mental healthcare support

Parental leave

Career progression

Résumé du poste

Legatics ищет инженера по безопасности, чтобы обеспечить безопасную разработку и эксплуатацию нашей платформы, облака и внутренних систем. Вы будете работать в тесном контакте с инженерной командой, внедрять требования по безопасности и участвовать в жизненном цикле разработки.

Обязанности включают оценку рисков, моделирование угроз, анализ уязвимостей, настройку мониторинга и реагирование на инциденты. Ищем практиков с опытом в облаках, IAM, SSO и OWASP, способных объяснить риски инженерам и

Qualifications

• Практический опыт в инженерии безопасности, безопасной разработке и облачной безопасности.
• Глубокие знания OWASP и подходов к управлению уязвимостями.
• Опыт проведения threat modelling, аудита кода и требований безопасности для новых фич.

Responsabilités

• Проводить технические риск-оценки и моделирование угроз для функций продукта.
• Встраивать безопасность в SDLC, проводить безопасный код-ревью и требования к безопасности.
• Проводить анализ уязвимостей, регламентировать работу с инженерами по устранению рисков.
• Поддерживать инструменты мониторинга, централизовать находки и доводить до исправления.
• Проводить аудит облачной и идентификационной безопасности, настройку SSO и политик доступа.
• Руководить тестированием на проникновение и реакцией на инциденты, включая цепочку поставок.

Connaissances

Security engineering

Application security

Cloud security

OWASP principles

Threat modelling

Web app security

Vulnerability management

Scripting (Python/TS/Bash)

Outils

SIEM/Observability tooling

EDR tooling

OAuth/SAML SSO

ISO 27001

Description du poste

Описание:

Legatics handles some of the world's most complex and confidential legal transactions, so security is core to our product and to client trust. As our Security Engineer, you will make our platform, cloud estate and internal systems secure by design, working hand in hand with our engineering team.

Задачи:

Carry out technical risk assessments on new and existing product features, including permissions and access control design Embed security into our software development lifecycle through threat modelling, secure code review and security requirements for new features Perform vulnerability and exploitability analysis, including CVE triage and dependency risk, and prioritise remediation with engineers based on real exposure Operate and consolidate our security scanning and posture tooling, and centralise findings so they are tracked and resolved Review the security risk of proposed integrations and data flows, including third-party tools and automations Run a programme of continuous security testing, including penetration tests, and own remediation of findings Audit and harden our cloud and identity posture, including SSO enforcement, conditional access and third-party app controls Automate joiner and leaver access, and run periodic user access reviews across our SaaS estate Own email security and authentication Own endpoint security across our Windows and Mac fleet, including EDR policy tuning and validation testing Design and maintain federated authentication with clear rollout guides and rollback procedures Build, extend and maintain security monitoring across our technical estate, including log aggregation, correlation and alerting Tune detection rules and alerting to improve signal quality and reduce false positives Maintain threat intelligence and security news pipelines to keep the team informed Lead detection, triage, containment and response for security incidents, including supply-chain compromises affecting third-party tools Assess blast radius, advise on practical containment and maintain escalation and breach procedures Write clear incident communications for technical and non-technical audiences, including clients where needed Shape our AI security posture, positioning security as an enabler for teams building with AI and agentic tools Implement access controls, secrets scanning and detection for internal AI systems and MCP integrations, mapped to frameworks such as the OWASP Top 10 for Agentic Applications Research AI coding risks, such as slopsquatting and hallucinated packages, and feed findings into engineering practice Our ISO 27001:2022 certified ISMS, including the risk register, Statement of Applicability, policies and audit evidence, and preparation for surveillance audits Client information security questionnaires and security queries from our commercial team, using the AI tooling we have built to speed these up Client conversations about our security posture and remediation updates, for example on penetration test findings After this period, you will continue to contribute technical controls, evidence and expertise to our ISMS and client assurance work. Support day-to-day IT and tooling needs as a secondary responsibility, including connector provisioning, access permissions and IAM configuration for internal data tools

Требования:

Hands-on experience in a security engineering, application security or cloud security role Strong knowledge of web application security, including OWASP principles, authentication and authorisation, and secure API design Practical experience of vulnerability management, from triage to working with engineers on remediation Hands-on experience securing major cloud, workspace and identity platforms, including SSO and conditional access Experience with security monitoring, log analysis and SIEM or observability tooling Experience of investigating and responding to security incidents Comfortable reading and writing code or scripts (for example Python, TypeScript or Bash) to automate security work Clear communication skills, able to influence engineers and explain risk to non-technical colleagues and clients Будет плюсом: Experience with EDR tooling; Working knowledge of ISO 27001, including audit evidence and client security questionnaires; An interest in, or experience of, AI and agentic security risks; A software engineering background; Experience in a startup or scale-up environment

Условия:

25 days holiday per year (plus public holidays) Early Finish Fridays - on the last Friday of every month, we finish around lunchtime! Pension with NEST Private Medical Insurance with Bupa, giving you fast access to diagnosis and treatment when you need it Healthshield Health Cash Plan, helping you claim money back on everyday healthcare like dental, optical and physio Personal Learning & Development budget Access to Mental healthcare for you and your immediate family Enhanced parental leave policies so you can spend more time with your family Lots of opportunities for accelerated professional development and career progression Work alongside a supportive and talented team with the opportunity to grow one of the world's leading LegalTech scale-ups A warm, genuinely collaborative culture and an awesome team; and Regular socials