Ryft
Lead Security Engineer
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
About Ryft
Ryft is a high-growth fintech start-up building the payments platform that powers marketplaces and merchants globally. We handle the secure processing, splitting, and movement of money at scale, so our customers can focus on their business instead of the complexity of payments. We're growing fast, and every hire has a real impact on our trajectory.
About the Role
We're looking for an experienced Lead Security Engineer to join a newly established, dedicated Platform Team and lay the foundation of our application security, cloud security operations (SecOps), and compliance automation. As a high-volume payments platform with strict PCI-DSS Level 1 compliance and continuous SOC 2 requirements, embedding automated security into our developer workflows is a core business driver.
Reporting directly to the CTO, you will work side-by-side with our Senior Platform Engineer to bake security and compliance directly into our AWS CDK infrastructure and GitHub Actions CI/CD pipelines. You will build automated guardrails that make shipping secure, audit-ready payment software second nature for our product engineers, while taking full ownership of our annual PCI-DSS and SOC 2 audit processes. This is a hands-on, high-ownership role. As a senior security leader, you'll set standards for threat modeling, vulnerability management, and incident response as we scale, in an environment where security and reliability are non-negotiable. You'll be comfortable working autonomously in a remote-first setup while staying closely connected to the engineering team.
Responsibilities
Application & Pipeline Security (Shift-Left SecOps)
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
- Implement automated Static Application Security Testing (SAST), software supply chain scanning, and container vulnerability scanning directly within GitHub Actions.
- Conduct threat modeling and architectural security reviews for core payment features, tokenization pipelines, and processor integrations.
- Partner closely with the Senior Platform Engineer to define secure, reusable AWS CDK (TypeScript) security patterns and automated IAM least-privilege policies.
Automated Compliance & Audit Management (PCI-DSS & SOC 2)
- Serve as the primary technical lead for external QSAs, auditors, and sponsor bank security questionnaires.
- Implement and manage continuous compliance automation platforms (e.g., Vanta, Drata) to eliminate manual screenshot collection.
- Maintain PCI-DSS Cardholder Data Environment (CDE) scoping, vulnerability scanning, penetration testing programs, and network segmentation proofs.
Cloud Security Operations & Incident Response
- Architect, configure, and monitor cloud security signals using AWS Security Hub, GuardDuty, CloudTrail, AWS WAF, and KMS key management.
- Establish incident response playbooks, automated alerting, and breach response protocols tailored for payment processing infrastructure.
- Enforce secrets management practices across GitHub, AWS Secrets Manager, and application runtimes.
Corporate Security & Laptop Endpoint Policy
- Manage automated endpoint security (MDM) using zero-touch provisioning tools (e.g., Kandji, Jamf, Rippling) to enforce disk encryption, screen locks, and automated OS patching out of the box.
- Oversee identity and access management (IAM) lifecycle across company tools (Okta / AWS IAM Identity Center) with strict multi-factor authentication (MFA) policies.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Technical Skills Required
- Hands-on AWS Security Expertise: Deep experience configuring AWS IAM, KMS, WAF, GuardDuty, CloudTrail, and VPC security controls.
- PCI-DSS Level 1/2 & SOC 2 Experience: Proven track record leading annual PCI-DSS audits and SOC 2 Type II evidence collection from start to finish.
- CI/CD Integration: Experience embedding security tooling (Snyk, Semgrep, Trivy, Dependabot) directly into GitHub Actions pipelines.
- Scripting / IaC Familiarity: Ability to read/write TypeScript or Python to collaborate on AWS CDK infrastructure definitions and audit automation scripts.
- AppSec & Threat Modeling: Strong grasp of OWASP Top 10, API security, and performing threat modeling on cloud microservices.
Nice to Have
- Payments/Fintech: Exposure to payment tokenization architectures, Hardware Security Modules (HSM), or point-to-point encryption (P2PE).
- Compliance Automation Tools: Direct experience using platforms like Vanta, Drata, or Secureframe to streamline QSA evidence gathering.
- Certifications: CISSP, CCSP, or AWS Certified Security - Specialty certifications.
Why Ryft?
If you're excited about working in a fast-paced, collaborative environment and want to build the security posture that powers the future of fintech, we'd love to hear from you. We value engineers who take ownership, automate relentlessly, and care as much about reliability and security as they do about speed.
Right to Work: Applicants must have the right to work in the UK.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location