Engineering Manager, Security

We are a fast-growing Fin Tech company looking for a talented and enthusiastic engineer to join our team. We are expanding, making this a perfect position if you would like to have a significant impact on our company’s growth and develop your role and career as the business evolves. You will join a team where your ideas will be welcomed and valued.

This is a senior individual contributor and leadership role. You will report to the CTO, with a functional dotted line to the Head of Compliance. You will work closely with engineering, compliance, and risk functions, and represent security at board level. You will be the architect of a security culture that is rigorous, pragmatic, and commercially aware. The role will be hands on at the outset.

Security strategy & governance:

• Own the information security strategy, aligned to FCA requirements, ISO 27001, and the firm’s risk appetite.
• Chair the Information Security Working Group; prepare materials for the board and Insignis Risk Committee.
• Lead the ISO 27001 programme, including ongoing audit readiness and continual improvement.
• Maintain and evolve the ISMS, risk register, and security policy suite.
• Represent security in regulatory engagements, including FCA supervisory requests and third-party due diligence.

Technical security & architecture:

• Define and enforce the security architecture across our Azure-native, Kubernetes-based platform.
• Govern security controls across the full stack:
  Kafka, .NET/C#, Vue.js, Kong API Gateway, Auth0, and Salesforce.
• Lead threat modelling, penetration testing, and vulnerability management programmes.
• Own identity and access management strategy, including Entra , Auth0, and partner federation.
• Drive security engineering best practices within product and platform teams.
• Build and govern security for AI and machine-learning systems — covering model and data governance, defences against prompt injection and model abuse, and safe adoption of generative-AI tooling across the business.
• Lead the firm's quantum-safe transition to post-quantum cryptography — maintaining a cryptographic inventory, assessing exposure, and planning a crypto-agile migration to NIST-standardised PQC algorithms.

Compliance & regulatory:

• Ensure security controls meet FCA SYSC obligations, SYSC 15A operational risk requirements and ISO
  27001 standard.
• Work closely with the Head of Compliance on regulatory horizon scanning, security-related policy obligations, and audit responses.
• Partner with the DPO on data governance and breach notification obligations.
• Manage third-party and supply chain security risk, including critical outsourcing oversight.

Incident management & operations:

• Own the security incident response plan; lead major incident management for cyber events.
• Operate and improve security monitoring, SIEM, and alerting across the Azure estate.
• Run the security awareness and training programme for all ~180 staff.
• Manage relationships with external SOC, MSSP, and specialist security partners.

• Demonstrable experience leading information security in a regulated financial services or fintech environment.
• Strong working knowledge of FCA regulatory requirements (SYSC, operational resilience).
• Hands-on familiarity with cloud-native security on Azure (Entra , Defender, Sentinel, Key Vault, Policy).
• Proven delivery of ISO 27001 certification or equivalent ISMS framework.
• Ability to translate technical risk into board-level narrative clearly and credibly.
• Experience partnering with engineering teams — you are comfortable in a technical conversation and a risk committee meeting.
• Familiarity with API security patterns (Kong, OAuth 2.0, OIDC) and modern identity architectures.
• Background in or strong exposure to software engineering —…