Senior Engineer, Software Security

Nothing; London (KY); On-site; USD 158,000 - 238,000; Full time

Job summary

Nothing is seeking a senior security engineer to own the security lifecycle for backend services and cloud platforms in London. You will define secure development standards, build tools, and drive vulnerability management with engineering teams.

You will lead threat modelling, implement SAST/DAST/SBOM, and collaborate with privacy and legal to address global regulations and emergent AI technologies. Expect a hands-on, architecture-focused role in a fast-growing company.

Qualifications

• 6+ years in application security and production posture management.
• Deep threat modelling expertise and ability to define methodologies.
• Hands-on cloud security across AWS, GCP, Azure and other hyperscalers.
• Secure SDLC governance: SAST, DAST, SBOM; know which findings matter.

Responsibilities

• Own security lifecycle and secure architecture for backend services and cloud platforms.
• Define secure development standards and integrate SAST, DAST and SBOM tooling.
• Lead vulnerability management end-to-end; triage findings and drive closure with engineers.
• Design security testing including pen testing and fuzzing; build reusable tools for others.
• Ship network, server-side and data protection: API security, WAF, encryption in transit and at rest.
• Collaborate with mobile/os/desktop teams on client-side security strategies.
• Work with privacy/legal to meet global regulations and emergent technologies like AI.
• Lead threat modelling across authentication, data protection and input handling; use AI/LLMs to simulate attacks.

Skills

Threat modelling

Cloud security

Secure SDLC

AI/LLMs in security

Cryptography & identity

Production-grade code

Security architecture

Tools

AWS

GCP

Azure

SBOM tooling

Job description

About Nothing

Nothing exists to make tech feel exciting again.

We're building a different kind of technology company, one that puts design, emotion, and human creativity at the heart of everything we do. From the way our products look and feel to how we communicate and show up in culture, we believe technology should make you feel something.

Founded in London in 2020, we've grown from idea to global challenger in just a few years. Backed by GV (Google Ventures), EQT Ventures, and C Ventures, and investors like Tony Fadell (iPod), Casey Neistat, and Kevin Lin (Twitch), we're now sold in 40+ markets with millions of users worldwide.

About the Team

Nothing builds phones, audio products and an operating system used by millions of people. Behind all of it sits Technology & Data in London: the backend services, cloud platforms and data infrastructure that make our products work. That stack runs across multiple cloud platforms such as AWS, GCP, Azure, and various other global hyperscalers. You'll be the engineer who defines how we secure the stack. Standards, tooling, strategies, tactics, architecture: you set them, and the hard part is doing it without slowing anyone down.

What You'll Do

• Own security lifecycle and secure architecture for Nothing's backend services and cloud platforms, from first design to live operations across all our CI/CD pipelines
• Define our secure development standards and wire SAST, DAST and SBOM tooling into how we ship.
• Own vulnerability management end to end: find issues, triage findings, and drive engineering teams to closure.
• Design our security testing, from penetration testing to fuzzing, and build tools other engineers can run without you.
• Ship network and server-side and data protection: API security, WAF, gateways, runtime defences, encryption in transit and at rest.
• Partner with our mobile, OS and desktop teams on client-side security tactics and strategy.
• Collaborate with our privacy and legal functions to help us engineer solutions to our global regulatory requirements focusing on emergent technologies such as AI
• Lead threat modelling across authentication, data protection and input handling. Use AI and LLMs to simulate attacks before they happen, then collaborate with the various teams to build the defences.

What We're Looking For

• 6+ years in application security, including security architecture you've designed for commercial products and services and have managed the posture of ongoing production.
• Deep threat modelling expertise. You can define the methodology for a company, not just follow one.
• Hands-on cloud security across AWS, GCP, Azure, and other global hyperscalers. You've secured backend services at real scale and depth of complexity.
• Command of the secure SDLC: SAST, DAST, SBOM and the judgement to know which findings matter.
• Experience applying AI or LLMs to security: simulating threats, probing defences, building countermeasures.
• Solid cryptography and identity fundamentals, including TLS, OAuth 2.0, SSO and token management. You write production-quality code in at least two of the languages such as Python, Go, Java, and C++, and know when to reach for each.
• You own a domain end to end, hold a high bar, and cut through ambiguity, whether the person across the table is an engineer or a lawyer.

How We Work

Location: London (Kings Cross & Farringdon offices)

Working Pattern: Full-time in our London office, five days a week. Occasional home working for personal needs is fine, but this isn't a hybrid role.

Commute: We ask that you live within a 60-minute commute of your office.