Senior Security Enablement Engineer

Phorest; Leatherhead; On-site; GBP 70,000 - 90,000; Full time

Benefits offered by this job

Private healthcare

Employee Share Purchase Scheme

Pension

Life Assurance

Income Protection

Bike to work scheme

Tax saver transport tickets

Enhanced Maternity and Paternity

Onboarding program

Learning & Development

Casual dress

Job summary

Phorest is seeking an experienced Security Engineer to elevate our security capabilities across engineering teams in the UK. You will embed with stream-aligned product squads, building security tooling and scalable processes that enable secure-by-default decisions.

You will lead threat modelling, strengthen our AWS security posture, and coach engineers to integrate secure practices into daily work and CI/CD pipelines.

Qualifications

• Demonstrable hands-on secure development experience (7+ years).
• Experience in payments or regulated SaaS (PCI DSS, GDPR).
• Strong ability to explain risk to technical and non-technical audiences.

Responsibilities

• Embed with stream-aligned engineering teams to weave security into CI/CD and cloud design.
• Build security tooling and processes that scale and identify capability gaps.
• Coach teams and create scalable security practices across the engineering org.

Skills

Security engineering

AWS security

Secure SDLC

Threat modelling

Security tooling

Communication

Tools

GuardDuty

Security Hub

WAF

CI/CD security tooling

Job description

• We’re adding to our security capability and we are looking for someone who can move the needle, not a ticket-taker, but an experienced engineer who takes initiative, builds things, and genuinely partners with our product and engineering teams and the wider business
• You’ll use your deep security expertise not only to solve complex problems, but to raise the security capability of the teams around you
• Reactive work eats into time that should be spent on proactive, strategic programmes
• You will change that dynamic: by building security tooling and processes that scale, identifying risks and capability gaps, and turning them into impactful improvements
• By embedding yourself in our engineering culture you’ll make security an integral part of how teams build and enable engineers to make good security decisions
• You will function primarily as an enabler, working across our stream-aligned engineering teams to build security knowledge, tooling, and practice where the work actually happens
• An integral part of your impact will come through coaching others, sharing knowledge and creating scalable practices that raise the security bar for our Engineering Team
• You will own security engineering outcomes - acting as SME, identifying cross-functional opportunities, and driving improvements through to impact
• Partner with engineering teams to introduce tooling that makes secure coding the path of least resistance. Identify opportunities to improve the security experience and take ownership of delivering improvements that materially reduce risk or friction
• Collaborate with platform engineers to weave security into CI/CD pipelines, our cloud environment and code review workflows, without creating friction or bottlenecks. Establish reusable patterns and practices that enable teams to adopt secure-by-default approaches
• Work with engineering leads to identify and prioritise process & tooling improvements against our real risk landscape, building shared agreement on what matters most
• Proactively identify security knowledge and capability gaps, and build confidence across Phorest engineering through collaborative threat-modelling sessions, documentation, and hands-on pairing, so teams can make good security decisions independently
• Embed with stream-aligned product teams at key stages like design, architecture review, pre-launch to provide security input as a trusted peer, not an external auditor. Coach teams through complex security decisions, helping them build their own capability
• Act as a subject matter expert and trusted partner between Security and Product & Engineering, helping teams understand security and compliance requirements
• Share security learnings, emerging threats and lessons from incidents across Engineering, creating reusable guidance that raises the baseline of secure engineering and proactively creates awareness for how teams consider security
• Work alongside the broader security and IT team to proactively monitor security signals and alerts, identify patterns and build shared situational awareness across the team
• Identify and assess emerging security risks and opportunities, conduct exploratory risk analysis that shapes the security programme roadmap, bringing in the engineering perspective you’ve built through close team relationships
• Build out security requirements and review processes for our AWS-hosted, multi-tenant SaaS environment
• Contribute to the on-call rota, providing security coverage for incidents as they arise
• Support security incident response end to end, from initial triage and containment through to post-incident review and remediation tracking

Benefits

• Your wellbeing is important to us - We provide private healthcare, and employee assistance program and a free online GP service (WebDoc)
• As part of our Financial Wellbeing, we provide an Employee Share Purchase Scheme, Pension, Life Assurance, and Income Protection
• We help you travel by providing a bike to work scheme as well as tax saver transport tickets
• We care for your family and provide Enhanced Maternity and Paternity benefits
• We grow our own timber! We provide a great learning environment including an extensive onboarding program
• Career development is important to us. We even have our own in-house Learning and Development/Business coach and many online resources including LinkedIn learning
• We don’t believe in formal dress codes. We prefer casual things

We’re looking for someone that creates momentum over responding to demand, we need someone who sees a risk or an opportunity, develops a point of view, and moves, keeping stakeholders informed along the wayYou are comfortable defining the problem, deciding your approach and owning the outcomeYou can bridge technical and non-technical worldsPhorest’s engineering teams are sharp and want genuine security partnership, but not everyone in the company is technical, so you will need to be credible with both explaining risk clearly to technical and non technical audiences, and translating security requirements into practical engineering guidanceYou seek feedback, challenge the status quo, embrace ambiguity and turn what you learn into action — sharing knowledge and raising the capability of those around youComfortable working in a distributed team where you own outcomes end to endFamiliarity with common vulnerability classes, OWASP, and secure SDLC frameworksComfortable working across SaaS, multi-tenant architecturesAble to build trust with engineering teams without relying on authorityStrong working knowledge of AWS security, IAM, GuardDuty, Security Hub, WAF, and related servicesDemonstrable Hands‑on secure development experience (preferably 7+ years); you have written production code at some point in your careerYou bring the soft skillsDeep enough experience in a security engineering or application security role to act as a subject matter expert for complex security challenges.Strong communicator, written, verbal, and asyncProactive in keeping stakeholders informed; you surface problems early rather than waiting to have answersComfortable using AI tools to accelerate security work, generating, and analysing at pace while keeping your human judgment at the center of every decision

Experience working in a payments or regulated SaaS environment (PCI DSS, GDPR, HIPAA)Familiarity with Team Topologies or other platform/enabling team modelsExposure to offensive security techniques, penetration testing, red teaming, or bug bountyExperience building security enablement or champion programmes that improve security capability and ownership across an engineering organisation