Senior DevSecOps Engineer

In this founding role, you’ll stand up security engineering from zero to go-live and scale it for a fast-growing, regulated trading platform. You’ll design guardrails and automation for cloud-native systems, balancing speed with risk management. You’ll partner with Infrastructure, Engineering, and product teams to embed security into CI/CD and incident response, influencing how we protect customers and regulators. This is a mission-driven opportunity to shape security foundations for a market-leading exchange with CFTC obligations.

• Stock Options
• Pension Scheme
• Health Insurance
• Enhanced Parental Leave
• Meals provided
• Cycle-to-Work Scheme

• Help stand up security engineering from the ground up through go-live and scale.
• Design and deploy security controls and guardrails across cloud-native platforms, including AI security for customer-facing and internal products.
• Automate security processes as code and embed compliance checks into CI/CD pipelines.
• Conduct risk audits, translate findings into actionable engineering recommendations, and implement them.
• Monitor system access logs, detect anomalies, and support incident response and post-incident analysis.
• Plan and test security backups and disaster recovery to ensure platform resilience.
• Develop and maintain security policies, standards, and controls for DCM/DCO and regulatory examinations.
• Collaborate with business and engineering teams to translate technical work for non-technical audiences.
• Foster a culture of security ownership among engineers.

• Hands-on security engineering/DevSecOps experience in cloud-native, high-growth environments, preferably financial services or exchange infrastructure.
• Strong written and verbal communication about security risk and controls to external stakeholders.
• Familiarity with CFTC safeguards and related regulations.
• Solid understanding of application security (OWASP Top 10, NIST) and secure SDLC.
• Proficiency with CI/CD tooling (GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI) and security tools (Snyk, Aqua, Trivy, Checkov, Twistlock, Clair).
• Hands-on security in AWS/Azure/GCP, Kubernetes, containers, and IaC.
• Knowledge of infrastructure-as-code and compliance-as-code practices.
• Automation proficiency in Python, Bash, or Go.

• Confident communicator
• Cross-functional collaboration
• Ownership mindset
• Cloud security (AWS/Azure/GCP)
• Kubernetes and container security
• CI/CD security tooling