Principal Security Engineer (Fintech)

Location: London, United Kingdom; hybrid working

Company

hirify.global is a regulated payments fintech building a financial platform for local businesses across Europe and expanding toward banking-licence-scale operations.

What you will do

• Own the application security side of hirify.global’s security operating model across product, platform, and infrastructure teams.
• Map delivery paths, baseline application security coverage, identify gaps, and establish an evidence-based security roadmap.
• Transform the SDLC into a secure SDLC with proportionate controls, secure defaults, reusable patterns, and developer-friendly guardrails.
• Embed SAST, SCA, secrets detection, DAST, and policy-as-code controls into engineering pipelines with trusted, actionable signals.
• Scale threat modelling, security champions, training, and self-service enablement across engineering teams.
• Shift risk management from severity labels toward exploitable attack paths and business impact.

Requirements

• Deep theoretical and practical application security expertise, including the ability to reason about unfamiliar systems.
• Proven experience transforming an SDLC into an SSDLC and selecting controls that reduce risk while improving developer velocity.
• Strong attacker mindset, with experience identifying actionable weaknesses and chaining them into realistic attack paths.
• Ability to communicate complex security concepts clearly to engineers, product managers, designers, operations, compliance, and other non-technical audiences.
• Practical understanding of software engineering, cloud security, identity, workload isolation, and production environments.
• Hybrid work in London, United Kingdom.

Nice to have

• Penetration testing, infrastructure or cloud security, red teaming, or related experience.
• Experience in regulated financial environments and familiarity with PCI DSS, ISO 27001, DORA, and GDPR.
• Experience engineering security solutions with Go.
• Exposure to PKI, HSMs, applied cryptography, or payments security.
• CREST, OffSec, CISSP, CISM, or equivalent certifications.

Culture & Benefits

• Security operates as an enabler rather than a veto function or review queue.
• Automation-first approach with visible backlogs, logged decisions, and clear boundaries between roadmap, operational, and unplanned work.
• Mandate to reshape secure software delivery across a scaling engineering organisation.
• Exposure to banking-licence-scale security work in a regulated payments environment.
• Competitive package, hybrid working, and a path toward management as the function grows.