Senior Security Engineer

Duco; London Borough of Islington; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Healthcare cashback

Private medical insurance

4X salary life assurance

Unlimited annual holiday

Enhanced family leave

Employee Assistance Programme

Cycle to Work and Tech Scheme

Volunteering days off

Flexible working policy (2 days in the

Opportunity to work abroad for up to 6

Job summary

Duco is seeking an experienced Senior Security Engineer (Cloud & SecOps) to own threat detection, response and prevention for our AWS-hosted SaaS platform. You will manage the SIEM and our managed SOC, define detection strategies and lead incident response while ensuring runtime security across our AWS estate.

You will work with a cross-functional team in London and Wrocław, reporting to the Head of Information Security, and collaborate with Engineering, Platform and IT to maintain strong

Qualifications

• Proven experience in a security operations or cloud security engineering role.
• Hands-on SIEM experience: design, tuning, and alert response.
• In-depth knowledge of AWS security services and architecture (IAM, SCPs, CloudTrail, GuardDuty, Security Hub).
• Experience with container/Kubernetes runtime security, ideally on EKS.
• Track record leading security incident response in cloud environments.
• Experience with managed SOC or MDR providers.
• Python or similar scripting for automation.
• Infra-as-code knowledge (e.g., Terraform, CloudFormation).
• Strong ability to communicate risk to non-technical stakeholders.
• Experience with detections-as-code practices and SOAR playbooks.
• CNAPP/CSPM tooling familiarity.
• Knowledge of DORA, ISO 27001, SOC 2 is a plus.

Responsibilities

• Own the run-time security posture of the AWS environment including IAM, guardrails, logging, and remediation of findings.
• Secure the corporate environment (Google Workspace, endpoints, SaaS) with IT collaboration.
• Lead infrastructure vulnerability management and external attack surface management.
• Coordinate pen-testing, scoping to remediation closure.
• Own the SIEM platform: onboarding, detection use cases, MITRE ATT&CK coverage.
• Manage the SOC relationship, SLAs, and incident response end-to-end.
• Automate security processes via scripting and IaC, deliver security metrics.
• Support audits and client assurance with evidence of controls.

Skills

Security operations

Cloud security engineering

SIEM tuning

AWS security services

Kubernetes runtime security

Incident response

Python scripting

Infrastructure as code

Effective risk communication

Detections via code

SOAR / automation

CNAPP / CSPM tooling

DORA / ISO 27001 familiarity

Job description

27 Goswell Rd., Barbican, London EC1M 7AN

About Us

Duco is on a mission to reduce the time spent on data-related work by 90%. Our enterprise data automation platform empowers teams to work more efficiently and meaningfully by giving them the ability to automate data controls with the latest technology, such as no-code, the cloud, and AI.

We help firms to start trusting their data, by giving them one intuitive platform to automate the front-to-back processing of all kinds of data (from structured Excels and RTFs to unstructured PDFs and emails). This eliminates the boring manual work across the data lifecycle and enables firms to act faster, work smarter, save money, reduce risk and comply with regulatory requirements.

We’re headquartered in London and have offices in New York, Wroclaw, Singapore, and Antwerp. We’re proud to call some of the largest global financial institutions our clients, including over 15 of the world’s largest international banks, as well as brokers, exchanges, asset managers, hedge funds, administrators, service providers and corporates.

The opportunity

We are seeking an experienced Senior Security Engineer (Cloud & SecOps) to join our Information Security team. In this role, you will take ownership of threat detection, response and prevention across our AWS-hosted SaaS platform.

As part of our continued investment in security operations, you will serve as the internal owner of both our Security Information and Event Management (SIEM) platform and our managed Security Operations Centre (SOC). You will define our detection strategy, hold our service provider to the highest standards and lead our response to security incidents. You will also be accountable for the run-time security of our AWS estate.

You will join a small, collaborative team based across London and Wrocław, working alongside our Governance, Risk and Compliance (GRC) function and our Senior Product Security Engineer, who is responsible for security across the software development lifecycle (SDLC) and CI/CD pipeline. You will partner closely with our Engineering, Platform and IT teams and report to the Head of Information Security.

Key responsibilities

Cloud and corporate security

• Own the run-time security posture of our AWS environment, including identity and access management (IAM), organisational guardrails, logging coverage and the remediation of cloud security findings
• Secure our corporate environment, including Google Workspace, endpoints and SaaS applications, partnering with IT to define and uphold identity, access and device security standards

Vulnerability and exposure management

• Lead the infrastructure vulnerability management programme, prioritising remediation on a risk basis and driving delivery with the Platform and IT teams
• Develop and oversee our external attack surface management capability
• Coordinate infrastructure and external penetration testing, from scoping through to tracking remediation to closure

Detection and incident response

• Own the SIEM platform, including log source onboarding, the development and tuning of detection use cases and coverage tracking against the MITRE ATT&CK framework
• Act as the internal owner of the managed SOC relationship, including escalation runbooks, service reviews, triage quality and service level agreements (SLAs)
• Lead security incident response end to end, from triage and containment through to post-incident review and root cause analysis
• Monitor the emerging threat landscape and recommend enhancements to our detection and response capabilities

Automation, reporting and assurance

• Automate repetitive security processes through scripting and infrastructure-as-code
• Deliver operational security metrics that inform risk reporting and key risk indicators (KRIs)
• Support internal audits and client assurance activities by evidencing the operating effectiveness of operational security controls

Skills and experience

• Proven experience in a security operations or cloud security engineering role
• Hands-on SIEM experience, including the design and tuning of detections in addition to alert response
• In-depth knowledge of AWS security services and architecture, including IAM, Organizations and Service Control Policies (SCPs), CloudTrail, GuardDuty, Security Hub, KMS and VPC design
• Experience with container and Kubernetes runtime security, ideally on Amazon EKS
• A track record of leading security incident response within cloud environments
• Experience working with or managing a managed SOC or Managed Detection and Response (MDR) provider
• Proficiency in Python or a comparable scripting language for automation
• Working knowledge of infrastructure-as-code
• The ability to communicate technical risk clearly and concisely to non-technical stakeholders
• Experience with detection-as-code practices
• Experience with Security Orchestration, Automation and Response (SOAR) platforms or automated response playbooks
• Experience with Cloud Security Posture Management (CSPM) or Cloud-Native Application Protection Platform (CNAPP) tooling
• Familiarity with financial services regulations and standards, such as the Digital Operational Resilience Act (DORA), ISO 27001 and SOC 2
• Relevant professional certifications, such as AWS Certified Security – Specialty, GCIH, GCIA or GCFA
• Experience applying threat intelligence to inform detection priorities

The reward package

• Competitive salary package aligned with your skills and experience. Reviewed annually
• Annual Performance-based bonus
• Healthcare cashback scheme and private medical insurance
• 4X salary life assurance
• Unlimited annual holiday, because we trust our people to manage their own time off
• Enhanced family leave
• Employee Assistance Programme
• Cycle to Work and Tech Scheme
• 4 Volunteering days off
• Flexible working policy (2 days per week in office)
• Opportunity to work abroad for up to 6 weeks per year
• Personal learning and development opportunities
• Referral bonus if we hire someone great who you’ve recommended to us
• Spot Rewards
• Employee of the Month and Employee of the Year awards

Want to do a little more research before you apply?

Head over to our Glassdoor page to learn about our benefits, culture and to find out what our team thinks about life at Duco. You can also find out more about us on LinkedIn

Disclaimer

Because we are committed to inclusivity, we strive to provide equitable opportunities for everyone. If you require accommodation during the recruitment process, please let us know at [e-mail]. Include your contact information, the role you're applying for, and how we can accommodate you.

During the interview process and after hire, Duco does not discriminate on the basis of race, colour, gender or gender expression, sexual orientation, marital or pregnancy status, national origin, age, disability, religion or creed, socioeconomic background or status, size, or any other protected characteristic.