About Numan

Founded in 2018, we’ve already grown to be a 300+ team distributed across the globe, united by a singular mission: empowering people to take control of their health.

Numan is transforming health: we’ve built a cutting-edge platform that integrates diagnostics, medication, supplements, digital programmes, and doctor consultations. Giving people the tools they need to maximise life.

To deliver on our transformative mission, we are guided by our 5 company values:

• Patients first.
• Learn fast.
• Own the quality.
• Succeed together.
• Care deeply.

Backed by top-tier investors, Numan is already having a positive impact on hundreds of thousands of patients here in the UK, and we want you to help us deliver this mission!

The Role

We build and operate a regulated digital health platform. Patients trust us with clinical data, identity documents and payment details, and our clinicians trust our systems to be correct. That makes application security a patient safety concern, not just a compliance one.

We are shipping quickly, adopting AI and agentic systems across clinical operations and patient-facing products, and running a lean security function that scales through engineering leverage rather than headcount. We need a senior engineer who can go deep on design and code, then bring the rest of the business along with them.

This is a hands-on individual contributor role with genuine influence over how the platform is built.

The Team

You will work within the Cyber Security function, collaborating directly with Engineering, Product, Clinical, Legal, and the executive team. Security at Numan is not a gatekeeping function — it scales through influence, credibility, and being useful early.

You'll be:

• Running threat modelling sessions with product and engineering teams on new features and architectural changes — STRIDE-based, with clinical safety, abuse, and business-logic threats kept in mind alongside the technical ones.
• Owning and evolving our Secure by Design process: self-evaluation screening, secure design review, and the threat modelling pathway, including our use of automated tooling against technical artefacts.
• Turning threat models into tracked, prioritised controls that engineering teams actually implement.
• Pushing design decisions upstream so the cheap fix is designed in rather than the expensive one retrofitted.
• Assessing and securing AI systems in production: LLM-backed features, retrieval pipelines, agentic workflows, tool-calling integrations, and the MCP and API surfaces that connect them.
• Building practical threat models and controls for agent-specific failure modes — prompt injection, tool misuse, excessive agency, data exfiltration through context, unsafe autonomy, and supply chain risk in model and plugin ecosystems.
• Performing automated application and API penetration testing against our own products — web, mobile backends, cloud-native services on GCP, internal tooling, and AI features.
• Leading penetration engagements with third parties and working on the fix with engineering.
• Chaining findings into realistic attack paths and demonstrating impact, rather than delivering a list of scanner output.
• Embedding security into our pipelines: SAST, SCA, secrets detection, IaC scanning, container and dependency hygiene — tuned so signal beats noise and engineers trust the gates.
• Working with platform and engineering to raise baseline standards: authentication and authorisation patterns, secrets management, tenancy isolation, and logging and detection coverage.
• Actively participating in the security community — OWASP chapters or projects, local meetups, CTFs, research groups — and publishing research, write-ups, or blog posts under your own name.