Senior Security Engineer

About UsDuco is on a mission to reduce the time spent on data-related work by 90%. Our enterprise data automation platform empowers teams to work more efficiently and meaningfully by giving them the ability to automate data controls with the latest technology, such as no-code, the cloud, and AI.We help firms to start trusting their data, by giving them one intuitive platform to automate the front-to-back processing of all kinds of data (from structured Excels and RTFs to unstructured PDFs and emails).

This eliminates the boring manual work across the data lifecycle and enables firms to act faster, work smarter, save money, reduce risk and comply with regulatory requirements.

We’re headquartered in London and have offices in New York, Wroclaw, Singapore, and Antwerp. We’re proud to call some of the largest global financial institutions our clients, including over 15 of the world’s largest international banks, as well as brokers, exchanges, asset managers, hedge funds, administrators, service providers and corporates.

The opportunity

We are seeking an experienced Senior Security Engineer (Cloud & Sec Ops) to join our Information Security team. In this role, you will take ownership of threat detection, response and prevention across our AWS-hosted SaaS platform.

As part of our continued investment in security operations, you will serve as the internal owner of both our Security Information and Event Management (SIEM) platform and our managed Security Operations Centre (SOC). You will define our detection strategy, hold our service provider to the highest standards and lead our response to security incidents. You will also be accountable for the run-time security of our AWS estate.

You will join a small, collaborative team based across London and Wrocław, working alongside our Governance, Risk and Compliance (GRC) function and our Senior Product Security Engineer, who is responsible for security across the software development lifecycle (SDLC) and CI/CD pipeline. You will partner closely with our Engineering, Platform and IT teams and report to the Head of Information Security.

Key responsibilities

Cloud and corporate security

Own the run-time security posture of our AWS environment, including identity and access management (IAM), organisational guardrails, logging coverage and the remediation of cloud security findings

Secure our corporate environment, including Google Workspace, endpoints and SaaS applications, partnering with IT to define and uphold identity, access and device security standards

Vulnerability and exposure management

Lead the infrastructure vulnerability management programme, prioritising remediation on a risk basis and driving delivery with the Platform and IT teams

Develop and oversee our external attack surface management capability

Coordinate infrastructure and external penetration testing, from scoping through to tracking remediation to closure

Detection and incident response

Own the SIEM platform, including log source onboarding, the development and tuning of detection use cases and coverage tracking against the MITRE ATT&CK framework

Act as the internal owner of the managed SOC relationship, including escalation runbooks, service reviews, triage quality and service level agreements (SLAs)
Lead security incident response end to end, from triage and containment through to post-incident review and root cause analysis

Monitor the emerging threat landscape and recommend enhancements to our detection and response capabilities

Automation, reporting and assurance

Automate repetitive security processes through scripting and infrastructure-as-code Deliver operational security metrics that inform risk reporting and key risk indicators (KRIs)
Support internal audits and client assurance…