Senior Security Engineer

We're looking for an experienced Security Engineer to help design, implement, and operate security across our infrastructure, applications, networks, and isolated computing environments.

This is a hands-on technical role covering identity and access management, cryptography, secrets management, endpoint security, secure software delivery, and on-premises infrastructure. You'll work across connected environments, client-site data centres, and air-gapped systems where security, reliability, and operational discipline are essential.

What you'll do

• Design and manage identity and access controls, including SSO, MFA, federation, privileged access, and machine identities.
• Configure and operate Keycloak or an equivalent self-hosted identity provider.
• Manage secrets, certificates, public key infrastructure (PKI), certificate authorities, and cryptographic keys, including secure key ceremonies.
• Secure Linux systems, networks, endpoints, and on-premises infrastructure.
• Implement security controls for air-gapped environments, including controlled data transfers, offline updates, and network segmentation.
• Secure self-hosted source control and CI/CD pipelines, ideally Git Lab Self-Managed, including secrets scanning, dependency management, and artifact signing.
• Support network security across multiple sites, including firewalls, IPsec tunnels, VPNs, reverse proxies, and access controls.
• Operate vulnerability management, security monitoring, incident response, and infrastructure hardening processes.
• Maintain technical documentation, security configurations, operational runbooks, and audit evidence.

What we're looking for

• At least 5 years of hands-on experience in security engineering, infrastructure security, or a closely related technical security role.
• Practical experience with identity and access management, ideally Keycloak, including OIDC, SAML, SSO, federation, and MFA.
• Experience with PKI, certificate lifecycle management, cryptographic keys, and secrets management platforms such as Hashi Corp Vault or Open Bao.
• Strong Linux, networking, and infrastructure security fundamentals.
• Experience securing on-premises environments, data centres, or isolated/air-gapped networks.
• Understanding of network segmentation, VPN/IPsec, firewalls, and secure remote access.
• Experience with source control and CI/CD security, preferably Git Lab Self-Managed.
• Ability to automate security tasks using Bash, Python, Ansible, Terraform, or similar tools.
• Experience with security monitoring, vulnerability remediation, and incident response.
• Strong problem-solving skills, attention to detail, and the ability to document and explain technical decisions.

Nice to have

• Experience operating an offline root CA and personally participating in or leading a formal key ceremony.
• Hands-on experience with hardware security modules (HSMs).
• Experience with MDM, endpoint detection and response (EDR), and zero-trust security.
• Experience in defence, government, financial services, or critical infrastructure.
• Familiarity with ISO 27001, SOC 2, or NIST security frameworks.
• Experience with on-premises Kubernetes and container security.