Platform Security Engineer

Who Are You?
You are a motivated, flexible and talented engineer who is enthusiastic about learning new things and challenging themselves. You’re not a lone ranger but believe in a joined up and friendly work environment that delivers real projects, working collaboratively excites you. You’re someone who takes pride in the things you do and likes to see things from beginning to end. You love the attention to detail and might admit it’s a blessing and a curse. You will champion new technologies when it’s right for the business. You’ll also need some personality, a strong GIF-game, and we’d love to know what you’re into.. to an extent.
Your Mission
To work alongside like‑minded people across our software engineering, architecture, infrastructure and testing teams. To be passionate about building security into everything we do; whether that’s threat modelling, hardening cloud environments, improving IAM, automating controls, or documenting best practice (or all of the above). To set high standards for yourself and the work you deliver, helping us create a secure, stable and trusted platform, enabling:

Secure‑by‑design applications and services
Safe, reliable and automated releases (working towards full CI/CD)
Strong detection, response and observability
A culture where security is shared, understood and championed

Your Stack
Essential
Google Cloud security fundamentals: IAM, VPC design, Cloud Armor, Secrets, KMS
Cloudflare: WAF, Zero Trust, Access, DNS, Bot Management
Infrastructure‑as‑Code security: Terraform, policy‑as‑code, secure pipelines
Container & Kubernetes security: GKE, admission controls, image scanning, RBAC
Experience mitigating real‑world security threats and vulnerabilities
Understanding of DevSecOps best practice and secure SDLC
Familiarity with CI/CD systems such as GitHub Actions and securing build pipelines
Monitoring & alerting: Prometheus, Grafana, GCP Monitoring, SIEM concepts

Nice to Have
Knowledge of any of: PHP, JavaScript, Go (for reviewing and securing code)
Experience with web servers & proxies: Apache, Nginx, Traefik, HAProxy
Exposure to databases such as MySQL, MongoDB, Firebase, Elastic, Redis
Event stack experience: Kafka, RabbitMQ, ActiveMQ, GCP Pub/Sub
Network & request tracing including HTTP/1–3 and gRPC
Experience running security workshops, threat modelling sessions or training

Soft and Fluffy Description of Skills
Able to plan and manage your workload across multiple projects and priorities
Comfortable collaborating, influencing and sharing knowledge with other teams
Passionate about secure, scalable and complex distributed systems
Confident communicating security concepts to both technical and non‑technical people
Motivated to push security forward across the business, not just maintain it