Senior Security Engineer (London, Hybrid)

Asset Reality; Greater London; Híbrido; GBP 90.000 - 130.000; Jornada completa

Descripción de la vacante

Asset Reality Limited in London is seeking a senior software engineer who will embed security into every layer of the product. You will ship production Go services and React UI on AWS, working in a small team where security is an intrinsic discipline rather than an afterthought.

You will lead threat modelling, architect secure AWS patterns (IAM, segmentation, secrets management) and drive secure design decisions across features, with incident response and client security support as part of the

Formación

• Five+ years as a software engineer with substantial security work.
• Strong backend development experience; Go preferred; able to work in Go.
• Hands-on ownership of cloud security in a production AWS environment.
• Threat modelling as a practiced discipline.
• Practical experience with application security in web apps backed by relational databases.
• Comfort in a small team where you will provide security depth.

Responsabilidades

• Contribute to day-to-day product development as a senior engineer: designing, writing, reviewing, and shipping production code in Go and React.
• Own the security dimension of engineering work: lead threat modelling on new features and architectural changes, drive secure design decisions, and review high-risk changes.
• Own and improve the security of our AWS estate: IAM design, network segmentation, secrets management, and data isolation in a multi-tenant system.
• Build security into the development lifecycle: dependency and vulnerability management, CI/CD security controls, static and dynamic analysis, and the tooling that makes the secure path the easy path.
• Design and build product security features where the domain demands them: audit integrity, tamper evidence, access controls, and data isolation.
• Lead the technical side of incident response: detection, investigation, and remediation, and the exercises that keep us ready.
• Support client-facing security work with technical depth: contribute to security questionnaires, due diligence responses, and client assessments where engineering answers are needed.
• Raise the security literacy of the wider team through design reviews, pairing, and pragmatic internal guidance — not policy documents.

Conocimientos

Security engineering

Go backend

AWS security

Threat modelling

Application security

Cloud security

IAM design

Network segmentation

Secrets management

Data isolation

CI/CD security

Vulnerability management

Descripción del empleo

Location: London Office/Hybrid (1-2 days on site)

Schedule: Full-Time

The Role

Most security roles protect data. This one protects evidence. Asset Reality builds mission-critical infrastructure for clients in law enforcement and government, operating in environments where records are examined adversarially and the stakes are high.

You will join a small engineering team as a working engineer with deep security expertise. This is not an advisory role and it is not a governance role. You will ship production code alongside the rest of the team — Go services, Postgres, React, all on AWS — and you will be the person who makes sure that what we ship stands up to adversarial scrutiny.

Security here is not a separate function reviewing the team's work from the outside. It is a discipline embedded in how the team designs, builds, and operates the product. You will set the standard for that.

Responsibilities

• Contribute to day-to-day product development as a senior engineer: designing, writing, reviewing, and shipping production code in Go and React.
• Own the security dimension of engineering work: lead threat modelling on new features and architectural changes, drive secure design decisions, and review high-risk changes.
• Own and improve the security of our AWS estate: IAM design, network segmentation, secrets management, and data isolation in a multi-tenant system.
• Build security into the development lifecycle: dependency and vulnerability management, CI/CD security controls, static and dynamic analysis, and the tooling that makes the secure path the easy path.
• Design and build product security features where the domain demands them: audit integrity, tamper evidence, access controls, and data isolation.
• Lead the technical side of incident response: detection, investigation, and remediation, and the exercises that keep us ready.
• Support client-facing security work with technical depth: contribute to security questionnaires, due diligence responses, and client assessments where engineering answers are needed.
• Raise the security literacy of the wider team through design reviews, pairing, and pragmatic internal guidance — not policy documents.

Essential Experience

• Five or more years as a software engineer, with substantial time spent in security-focused work — whether as a security engineer, a product engineer who owned security, or something in between. You are comfortable being measured as an engineer first.
• Strong backend development experience. Go strongly preferred; deep experience in a comparable language with willingness to work in Go is acceptable.
• Demonstrable, hands-on ownership of cloud security in a production AWS environment. You should be able to reason about IAM design, network segmentation, secrets management, and data isolation in a multi-tenant system without reaching for a reference.
• Threat modelling as a practised discipline rather than an occasional exercise — and the ability to run it with engineers who haven't done it before.
• Practical experience with application security: you can find, exploit, and fix the vulnerabilities that matter in a web application backed by a relational database, and you know which ones don't matter.
• Comfort working in a small team where you will be the security depth, without a larger security function behind you.

Desirable

• Experience in a domain with irreversible, high-value transactions: digital asset custody, payments infrastructure, finance, or similar.
• Frontend experience with React, or enough to be dangerous in code review.
• Experience supporting a formal security or compliance regime from the engineering side — SOC 2 Type II, ISO 27001, or a government assurance framework.
• Detection and response tooling experience, particularly building or operating it rather than just buying it.
• Experience as the first or only security-focused engineer somewhere.
• Postgres depth: schema design, row-level security, performance under audit-heavy workloads.

Privacy Notice

Asset Reality will process the personal information you provide as part of your application, including your CV, contact details, employment history, qualifications, and recruitment-related communications, for the purposes of assessing your suitability for employment, managing the recruitment process, and meeting legal obligations. We retain recruitment records for up to 12 months following completion of the recruitment process unless a different retention period is required by law. By submitting an application, you acknowledge that you have read and understood our Candidate Privacy Notice.