Ebury is investing heavily in product and platform security across our global financial services ecosystem. Security Engineering is a deeply technical, hands-on discipline that partners directly with software and platform engineers to build security into every stage of the release lifecycle. Scope distinction: This team focuses purely on core engineering challenges, not GRC, policy writing, IT desktop security (e.g., endpoint AV), or SecOps/incident response. You will lead a distributed team of elite security engineers spanning cloud security, penetration testing, and software development. Your mandate covers vulnerability management, AI threat modelling, secure software development lifecycles (SSDLC), agentic SDLC workflows, disaster recovery planning (DRP), and cloud infrastructure hardening. Reporting to the Engineering Director – Platform & Security, you will balance strategic architectural leadership with deep technical execution to safeguard our services in a high-scale, regulated fintech environment.
Responsibilities
Manage, recruit, and mentor a global team of security engineers, fostering technical excellence and clear career progression paths; Define and implement high-level security architecture across existing systems and greenfield projects; Partner with Software Engineering and Platform leadership to embed security requirements into roadmaps and sprint cycles; Stay actively hands-on: conduct architecture design reviews, review critical code, and act as the final decision-maker on complex technical security trade-offs; Deliver measurable, data-backed metrics and reporting on technical security posture to executive stakeholders; Define and scale the SSDLC strategy, integrating automated security testing (SAST, DAST, SCA) into CI/CD pipelines; Institutionalise continuous threat modelling across product teams; Design and evolve guardrails and secure frameworks for agentic software development and AI-assisted workflows; Direct the end-to-end vulnerability management programme, including continuous discovery, context-aware triage, remediation SLAs, and board-level risk reporting; Partner with engineering managers to resolve systemic and critical vulnerabilities; Direct AI-assisted tooling strategies, including continuous scanning pipelines and internal automated red-teaming platforms; Direct identity and access management architecture across multi-cloud infrastructure and customer-facing microservices; Ensure authentication, authorisation, least privilege, and Privileged Access Management (PAM) controls satisfy compliance and internal audit benchmarks; Collaborate with Platform Engineering to define security guardrails on AWS and GCP (network segmentation, perimeter defence, container runtime security); Review and sign off on high-risk architectural changes across platform and cloud network boundaries; Support technical external audits and close compliance gaps (ISO 27001, SOC 2, DORA) through direct engineering implementations
Requirements
8+ years of total experience across software engineering, platform engineering, or security engineering, including 3+ years directly managing engineering teams; Former software engineer or technical security specialist who transitioned into engineering management while retaining deep technical fluency; Proven track record designing, building, and running security controls at scale across public clouds (AWS and/or GCP) and container orchestration systems (Kubernetes); Hands-on mastery of secure coding practices, modern DevSecOps integration, threat modelling, and federated identity protocols (OAuth2, OIDC, SAML); Proven ability to translate high-level business risk into prioritised, actionable engineering backlogs; Strong track record delivering multi-quarter technical initiatives from inception to measurable completion; Data-driven decision-maker comfortable defending technical positions to executives and engineers alike; Pragmatic delivery mindset: balancing ironclad security controls with engineering velocity; Professional experience within regulated financial services, fintech, or payment processing environments; Practical understanding of security frameworks (NIST CSF, ISO 27001, CIS benchmarks); Exceptional written and verbal communication in English, with the clarity to articulate nuanced risk concepts to cross-functional teams; Demonstrated success leading remote or distributed teams across multiple geographies
Nice to have
Experience dual-running or migrating workloads across both AWS and GCP; Hands-on experience operationalising LLM/AI security models or agentic automation in software engineering; Industry certifications reflecting broad architecture and offensive depth (e.g., CISSP, CISM, OSCP, or hyperscaler Security Specialties)
Hiszpania · Madrid; London
