Senior Security Engineer

wavemm1; United Kingdom; À distance; GBP 84 000 - 140 000; Plein temps

Avantages offerts par ce poste

Health insurance

Parental leave

Fertility assistance

Flexible vacation

Charity donation matching

Annual travel

Résumé du poste

Wave is seeking an experienced Security Engineer to drive our application security program while collaborating with product teams to enhance our security posture across platforms. You will also help secure agentic AI systems and establish governance around AI usage and data handling.

You will work on diverse security projects—from secure code reviews to policy enforcement—while supporting MCP integrations and ensuring robust protection for customer data in a remote-friendly environment.

Qualifications

• 7–8 years of professional experience, with 3–5 years in security-oriented roles.
• Strong experience with Python.
• Fluent English, excellent communication and collaboration skills.

Responsabilités

• Own application security across Wave’s products, partnering with product teams.
• Secure AI-powered agent tooling and define guardrails for safe usage and governance.
• Secure MCP integrations against prompt injection, credential exposure, and tool misuse.
• Develop internal AI governance standards covering data handling, acceptable use, and audit requirements.

Connaissances

Python

Fluent English

Description du poste

Our mission

We're making Africa the first cashless continent.

In 2017, over half the population in Sub-Saharan Africa had no bank account. That's for good reason-the fees are too high, the closest branch can be miles away, and nobody takes cards. Without access to financial institutions, people are forced to keep their savings under the mattress. Small business owners rely on lenders who charge extortionate rates. Parents spend hours waiting in line to pay school fees in cash.

We're solving this by building financial services that just work: no account fees, instantly available, and accepted everywhere. In places where electricity, water and roads don't always work, you can still send money with Wave. In 2017, we launched a mobile app in Senegal for cash deposit, withdrawal, and peer-to-peer and business payments. Now, we have millions of users across 9 countries and are growing fast.

Our goal is to make Africa the first cashless continent and that's where you come in...

How you’ll help us achieve it

We’re looking for an experienced security engineer who’s independent, excited about getting things done, and ready to hit the ground running. You’ll primarily be responsible for our application security, working with our product teams to work on new systems to enhance our security posture. Our customers trust us with their money, and you’ll be at the forefront of making sure we retain that trust!

This broadly scoped role will allow you to get your hands on many different types of security projects, from direct application security to helping our infrastructure team think about security for our databases.

As we integrate AI-powered agents into our engineering and operations workflows, you’ll help define and enforce the guardrails around how we use them safely. This includes securing agentic tooling against prompt injection, excessive permissions, and data exfiltration - and building the policies and technical controls to govern AI usage across the company.

Some experience with common industry certifications like ISO-27001 and PCI-DSS would be beneficial, although you won’t be expected to run or oversee audits.

Our to-do list changes constantly, but here are some recent projects:

• Design our agentic SIEM/SecOps pipelines to evaluate and tune AI-driven triage, alerting, and response automation
• Secure our MCP integrations against prompt injection, tool misuse, and credential exposure
• Tune and maintain code security review agents tailored to Wave’s codebase, threat model, and regulatory environment
• Develop internal AI governance standards covering acceptable use, data handling, and audit requirements for LLM-powered tools
• Centralise application-level login and permissions enforcement including privileged access management
• Rework our approach to secrets management with fleeting secrets and tighter access scopes
• Security review of our public-facing APIs

Key details

You can work remotely from anywhere (between UTC -5 and +4) with reliable internet access.

Wave covers travel once per year to one of our operating countries in Africa, as well as a yearly stipend of $1200 to meet with coworkers.

Our salaries are competitive and are calculated using a transparent formula. For this role, depending on your level of experience, we offer a salary of up to $185,800 USD (or local equivalent), plus a generous equity.

We run performance reviews twice a year and award bonuses or promotions to strong performers who have been with the company for more than six months.

Major benefits

• Subsidized health insurance for you and your dependents and retirement contributions (both vary from country-to-country).
• 6 months fully paid parental leave and subsidized fertility assistance.
• Flexible vacation, with most folks taking between 30-40 days per year.
• $10,000 annual charitable donation matching.
• Yearly travel to one of our African operating countries.

Requirements

• Minimum of 7-8 years of professional experience with a minimum of 3-5 years of it spent in a security-related role
• Strong Experience with Python.
• Fluent English.

You might be a good fit if you

• Are excited about finding the right balance between security and velocity.
• Have opinions on how to secure agentic AI systems and want to put them into practice
• Enjoy helping other engineers understand and implement secure patterns.
• Are not afraid to take on complicated systems.
• Are excited to work on lots of different security-related work, from audits to code refactors.
• Work to make things easier for the next engineer who will touch your code.
• Always try to improve as a programmer and colleague.
• Are interested in building governance frameworks for AI usage in a regulated financial services environment
• Have experimented with LLM-based security tooling and understand both the promise and the failure modes
• Push through hard problems without giving up.
• Have experience remediating non-conformities.
• Are interested in security-focused source code review an