Security Engineer

We hold payment data, personal data, and the operating stacks of several small businesses. Keeping that quiet is the work. This role reads what we ship, finds the ways in, and writes the fixes. What you’d do…

We hold payment data, personal data, and the operating stacks of several small businesses. Keeping that quiet is the work. This role reads what we ship, finds the ways in, and writes the fixes.

• Pre-release code reads across the stack — Next.js (Type Script), Frappe (Python), Phoenix (Elixir), occasional Rust/C++
• Infrastructure audits: secrets management, access reviews, network segmentation, dependency SBOMs
• Incident response when something goes wrong; written post-mortems the whole team can learn from
• Threat modelling at the start of new systems — a seat at the table before the first commit

• 5+ years in application security or security engineering
• OWASP comfort: auth, sessions, secrets, injection, SSRF, CSRF, deserialisation — the full ten
• Hands‑on with at least two of the languages we ship (reading production code at speed)
• Familiar with UK data law: UK GDPR, PCI‑DSS as far as it reaches a small practice

• Published CVEs, bug bounty track record, or security‑focused OSS work
• ISO 27001 / SOC 2 experience from a company that actually passed audit
• Hardware or firmware security exposure (we occasionally touch embedded clients)

• Remote, UK time zones; part‑time (2–3 days/week) is viable for the right senior candidate
• Written reports preferred over shouted alerts

Duration

Your own time

Stage 1 of 6

II

The first reading

Every application is read by a partner, not screened out by a filter.

A partner reads what you sent. You hear back within five working days — either an invitation to speak, an honest refusal with a short reason, or an ask for a specific thing we need to decide.

Duration

Within one week

Stage 2 of 6

III

The conversation

A proper meeting, not a screening call.

Two partners, you, a shared agenda sent twenty‑four hours in advance. We talk about the work you have done, how we would work together, and the questions you have brought with you.

Duration

Thirty minutes, by video

Stage 3 of 6

IV

A short piece of work

Role‑dependent. If it looks like work, we pay for it.

For technical and craft roles, a short brief returned in your own time. The brief is representative of what the house actually does — no synthetic puzzles. If the task reads as commercial‑length work, we pay you a day rate for the time.

Duration

Two to four hours
· paid when commercial‑length

Stage 4 of 6

V

The final sitting

You meet all three readers of the house.

The three partners who run the practice sit with you. The decision is usually made in the room; where it is not, we tell you when to expect a reply.

Duration

Sixty minutes
· video or in Cambridge

Stage 5 of 6

VI

The offer, in writing

Written terms, standard form, countersigned.

A short offer letter — role, start date, salary, holiday, notice. Signed by both sides. First day is usually within three weeks.

Duration

The same week

Stage 6 of 6

When you are ready