Security engineer in fintech

Saturn is a Series A-backed fintech transforming how financial advice is delivered. As a Security Engineer, you will own the security of the systems financial institutions trust with sensitive client data and regulated financial workflows: our applications, our cloud infrastructure and the engineering practices that produce them.

• Application and API security across Saturn’s web applications, backend services and integrations, including authentication, authorisation, session management and firm-level data separation
• AWS security, covering IAM, network controls, secrets, encryption and workload isolation
• Threat modelling and security review for new systems, financial workflows, external integrations and AI capabilities, joining projects early enough to change their design
• Vulnerability management end to end: discovery, prioritisation by real risk, remediation and verification across code, dependencies, cloud resources and employee systems
• Security tooling and automation, including checks built into CI/CD, so the same work is never done manually twice
• Detection and incident response, from logging and alerting through investigation and recovery, turning each incident into a lasting improvement to systems and controls
• AI security, including prompt injection, unsafe tool execution, retrieved data and sensitive information disclosure
• Evidence and assurance for SOC 2, enterprise security reviews and customer due diligence, plus the reusable security patterns engineering teams adopt as standard

• 3+ years in security engineering, software engineering, infrastructure security or a closely related role, with a track record of improving the security of production software or cloud infrastructure
• Strong command of common web and API vulnerabilities including the OWASP Top 10, and practical knowledge of authentication, authorisation, sessions, secrets and encryption
• Hands-on experience securing AWS or another major cloud platform, including IAM, network security and cloud-native controls
• You have run threat modelling and architecture reviews, and you recommend proportionate controls that fit the system and its stage rather than the textbook answer
• You can write software and automation in Go, TypeScript, Python or a comparable language, and you integrate security checks into how engineers already work
• Understanding of security logging, monitoring and incident investigation, and comfort owning a problem through investigation, remediation and verification
• You start from the likely harm and attack path, separate material risk from low-value security work, and prioritise sensibly with incomplete information
• You describe risks and mitigations clearly enough that engineers, customers and leadership can act on them, and you document accepted risks rather than leaving them implicit
• Будет плюсом: Security engineering in financial services or another regulated domain; Application or product security for a B2B SaaS platform, including data isolation in multi-tenant systems; AWS security services, infrastructure as code, and enterprise identity integrations such as OAuth, OIDC and SAML; Detection engineering, SIEM or cloud security monitoring, incident response or digital forensics; SOC 2, ISO 27001 or enterprise customer security reviews; Penetration testing or working with external security researchers

• Competitive salary with regular appraisals
• Competitive equity package at an early stage company with high growth potential
• Our beautiful new five-floor office, “The Dome”, equipped with an onsite gym and roof terrace
• Best-in-class dental and medical insurance
• A dedicated budget for learning and professional development
• Access to an additional world-class gym and wellness centre two minutes from the office
• A tight-knit, ambitious team that cares deeply about quality and each other