Senior Security Engineer - UK
- Compensation
- Not disclosed
- Location
- London, London, City of, United Kingdom
- Work setup
- Hybrid
- Seniority
- Senior
- Employment
- Not specified
- Experience
- 7+ years
- Category
- Security
- Posted
Skills
Must have
- 7+ years in software or cloud security with a hands-on engineering background, with working experience in each of the following areas, using one or more of these or comparable tools: Cloud platforms:
- Has built or specified security gates in CI/CD pipelines that stop a change that fails a security requirement.
- Has hands-on experience with infrastructure as code guardrails, secrets and key management, and policy as code.
- Has prepared the evidence for an external security audit or certification, such as ISO 27001, PCI DSS, Cyber Essentials Plus, or SOC 2, and answered the auditors' questions in the audit sessions. Know
- Has scoped an independent security assessment, such as a penetration test, and tracked its findings to closure.
- Has led the response to a major security incident, including containment, stakeholder communication, and the post-incident review.
- Has answered a customer's security team directly, including the people whose job is to test the answers they are given.
- Can explain security to people who are not security specialists.
- Has identified a security investment that had not been requested, built the case for it, and got it funded or scheduled. Can describe the argument that worked and the one that did not.
Nice to have
- Has taken a new product through ISO 27001, PCI DSS, or Cyber Essentials Plus certification.
- Has worked under a formal data classification scheme set by a customer or a regulator, and knows what each tier requires in practice: data residency, access control, encryption, retention, and who is
- A security certification such as CISSP, CCSP, OSCP, AWS Certified Security Specialty, or Google Professional Cloud Security Engineer.
- Written security documentation, including evidence packs, control narratives, and security policy.
- Has incorporated AI into their security practice, for example triaging scan output and drafting control narratives.
- Understands how contractual and regulatory restrictions limit what data may be processed by AI tooling, and can explain the operational implications to a team that wants to use it.
- Has represented a supplier at a customer's security governance forum, change advisory board, or service review.
- Experience of a regulated or public sector engagement where the security posture had contractual or financial consequences.
- Has run a security awareness or culture initiative that changed how other teams behaved, and can say how they know it did.
- Active in the security community, through conferences, vulnerability disclosure, open source, or research.
Full description
About OneView Commerce
For retailers with thousands of shops, commerce platforms have historically fallen into two categories, each with significant drawbacks. Web-native platforms move fast but were never built for a shop floor. Legacy store systems were built for the shop floor but take a year to change anything. OneView Commerce is the third option: a headless commerce platform for physical retail that lets the world's largest retailers innovate just as quickly as the smaller ones. We ship store experiences that deploy fast out of the box, and we give retailers the freedom to build their own on top of a headless transaction engine engineered for the physical store rather than the browser.
Our customers are global retailers who build on OneView because it lets them keep moving: new journeys, new channels, and new store formats ship continuously rather than waiting on the next multi-year program.
Founded in 2010 to close the gap between fast-moving e-commerce and slow-moving in-store systems, OneView's founding principle is a single view of customers, orders, and inventory throughout the shopping journey. That remains our mission as we enable retailers to deliver exceptional store experiences that build loyalty.
We are a remote-first team with Viewers working across the globe, and we operate as a trusted provider of digital commerce systems for leading retailers.
Position summary
OneView is looking for a Senior Security Engineer to join our DevSecOps team and own the growth and ongoing management of our InfoSec program, covering cloud-hosted applications and infrastructure, security culture, and customer security requirements.
You write security policy and standards, which the Sr. Director of Platform Engineering approves, and design the controls that implement them. The team's technical product owner ranks security work on the backlog with everything else, and platform engineers build most of it. Most of your time goes to design, review, assurance, and incident work; you also write Terraform when it is the fastest way to get a control in place. You work with engineering, delivery, and executive stakeholders on decisions that need a security view.
You report to the Sr. Director of Platform Engineering, who sets vision, strategy, and the roadmap for Platform Engineering, and owns how the team's work gets done: technical approach, standards, assignment, and quality. This is an individual contributor role with no direct reports.
Our approach is defense in-depth and shifting security checks earlier in the delivery pipeline.
We use AI throughout our day-to-day work and want you to find uses for it we have not thought of. We also expect you to be able to do this job well if it were switched off tomorrow, because the judgment calls and the relationships with auditors and customers are yours.