Engineering Manager, Security

About this role

We are a fast-growing FinTech company looking for a talented and enthusiastic engineer to join our team. We are expanding, making this a perfect position if you would like to have a significant impact on our company’s growth and develop your role and career as the business evolves. You will join a team where your ideas will be welcomed and valued.

This is a senior individual contributor and leadership role. You will report to the CTO, with a functional dotted line to the Head of Compliance. You will work closely with engineering, compliance, and risk functions, and represent security at board level. You will be the architect of a security culture that is rigorous, pragmatic, and commercially aware. The role will be hands on at the outset.

Role responsibilities

Security Strategy & Governance

• Own the information security strategy, aligned to FCA requirements, ISO 27001, and the firm’s risk appetite.
• Chair the Information Security Working Group; prepare materials for the board and Insignis Risk Committee.
• Lead the ISO 27001 programme, including ongoing audit readiness and continual improvement.
• Maintain and evolve the ISMS, risk register, and security policy suite.
• Represent security in regulatory engagements, including FCA supervisory requests and third-party due diligence.

Technical Security & Architecture

• Define and enforce the security architecture across our Azure-native, Kubernetes-based platform.
• Govern security controls across the full stack: Kafka, .NET/C#, Vue.js, Kong API Gateway, Auth0, and Salesforce.
• Lead threat modelling, penetration testing, and vulnerability management programmes.
• Own identity and access management strategy, including Entra ID, Auth0, and partner federation.
• Drive security engineering best practices within product and platform teams.
• Build and govern security for AI and machine-learning systems — covering model and data governance, defences against prompt injection and model abuse, and safe adoption of generative-AI tooling across the business.
• Lead the firm's quantum-safe transition to post-quantum cryptography — maintaining a cryptographic inventory, assessing exposure, and planning a crypto-agile migration to NIST-standardised PQC algorithms.

Compliance & Regulatory

• Ensure security controls meet FCA SYSC obligations, SYSC 15A operational risk requirements and ISO27001 standard.
• Work closely with the Head of Compliance on regulatory horizon scanning, security-related policy obligations, and audit responses.
• Partner with the DPO on data governance and breach notification obligations.
• Manage third-party and supply chain security risk, including critical outsourcing oversight.

Incident Management & Operations

• Own the security incident response plan; lead major incident management for cyber events.
• Operate and improve security monitoring, SIEM, and alerting across the Azure estate.
• Run the security awareness and training programme for all ~180 staff.
• Manage relationships with external SOC, MSSP, and specialist security partners.

Requirements

Essential

• Demonstrable experience leading information security in a regulated financial services or fintech environment.
• Strong working knowledge of FCA regulatory requirements (SYSC, operational resilience).
• Hands-on familiarity with cloud-native security on Azure (Entra ID, Defender, Sentinel, Key Vault, Policy).
• Proven delivery of ISO 27001 certification or equivalent ISMS framework.
• Ability to translate technical risk into board-level narrative clearly and credibly.
• Experience partnering with engineering teams — you are comfortable in a technical conversation and a risk committee meeting.
• CISM, CISSP, or equivalent professional qualification (or demonstrable equivalent experience).

Desirable

• Familiarity with API security patterns (Kong, OAuth 2.0, OIDC) and modern identity architectures.
• Background in or strong exposure to software engineering — understanding of SDLC security, threat modelling, and DevSecOps.
• Experience managing a security team and developing talent toward senior positions.
• Familiarity with Kafka-backed event architectures and the security considerations they introduce.
• Awareness of AI and machine-learning security risks and emerging AI governance frameworks (e.g. NIST AI RMF, ISO/IEC 42001).
• Understanding of post-quantum cryptography and quantum-safe migration and crypto-agility planning.

Benefits

• 25 days holiday (exc. Bank holidays)
• 5% Pension contributions
• Private medical insurance with Vitality
• Health cash Plan offering contributions to dental, optical and much more
• Enhanced Parental Leave
• Cycle to Work Scheme
• Monthly team lunches, quarterly company socials

Working pattern

• Hybrid working pattern in London office, 3 days in the office (Tuesday to Thursday), 2 days remote.

About cyber security & digital forensics roles for ex-police

Cyber security, digital forensics and incident-response roles. DMIs, cybercrime investigators and digital forensics officers bring evidential discipline and investigative judgement that DFIR and security teams struggle to hire.