Cyber Security Engineer

About Lendable

Lendable is on a mission to build the world's best technology to help people get credit and save money. We're building one of the world's leading fintech companies and are off to a strong start:

• One of the UK’s newest unicorns with a team of just over 600 people
• Among the fastest-growing tech companies in the UK
• Profitable since 2017
• Backed by top investors including Balderton Capital and Goldman Sachs
• Loved by customers with the best reviews in the market (4.9 across 10,000s of reviews on Trustpilot)

So far, we’ve rebuilt the Big Three consumer finance products from scratch: loans, credit cards and car finance. We get money into our customers’ hands in minutes instead of days.

We’re growing fast, and there’s a lot more to do: we’re going after the two biggest Western markets (UK and US) where trillions worth of financial products are held by big banks with dated systems and painful processes.

About the role

We are looking for a hands-on Staff Cyber Security Engineer to join our Info Sec team and help secure our growing platform and products.

This role requires an engineer who can bridge the gap between development teams and security governance, ensuring we maintain a high standard of security, operational resilience, and regulatory compliance as we scale.

You will be instrumental in the execution of our security strategy, directly contributing to our Application Security programme, advancing our Dev Sec Ops  capabilities, and supporting key Governance, Risk, and Compliance (GRC) activities.

What you’ll be doing

This is a hybrid role covering both technical security implementation and critical compliance/risk management support:

Application Security & Dev Sec Ops

• Secure Development:
  Work directly with engineering teams to embed security best practices throughout the SDLC.
• Automation:
  Implement, maintain, and tune Dev Sec Ops  tools and pipelines (SAST, DAST, SCA) to automatically identify and remediate security flaws in code and infrastructure.
• Threat Modelling:
  Conduct and facilitate threat modelling sessions for new features and systems to proactively identify design-level risks.
• Vulnerability Management:
  Triage, validate, and track vulnerabilities identified across applications and infrastructure, driving efficient remediation efforts.
• Security Architecture:
  Provide technical advice on the secure design and configuration of our cloud environment (AWS/GCP) and associated technologies (Kubernetes, Git Ops, Snowflake, Vault).

Governance, Risk, & Compliance (GRC)

• Vendor Security Reviews:
  Execute vendor security assessments and due diligence reviews for new and existing third-party suppliers, maintaining required documentation for the Vendor Governance Forum.
• Audit Support:
  Assist the team in achieving and maintaining compliance with key regulatory and industry frameworks, including GDPR, ISO 27001, SOC2, and PCI DSS, by gathering evidence and documenting controls.
• Policy & Standards:
  Help translate high-level security policies into practical, actionable security standards and control requirements for engineering teams.
• Risk Reporting:
  Document and track identified risks from App Sec, vendor reviews, and operations, ensuring they are accurately captured and reported.
• Security Training:
  Support the delivery of security awareness and training programs tailored for technical and non-technical staff.

What we're looking for

• Proven, senior experience as a Cyber Security Engineer or similar role
• Hands-on experience implementing and managing security tooling within CI/CD pipelines
• Familiarity with modern cloud environments (AWS, GCP, or Azure) and container orchestration technologies (e.g., Kubernetes)
• Practical experience in conducting vendor security assessments and performing…