Senior Security Assurance Engineer (Internal Penetration Testing)

Triple Point

Since 2004, we’ve been bringing investment ideas to life and connecting capital with the right people and opportunities. Today, we manage more than £2.5 billion for a broad range of investors across five key investment strategies: Private Credit, Social Housing, Clean Heat, Energy and Venture. These strategies underpin the innovative range of investments we offer to both private (retail) and institutional clients.  There are 230+ employees at Triple Point, all committed to leaving the world demonstrably better than we found it. That’s why we’re a certified B Corp, signed up to the Principles for Responsible Investment, and were named a Sunday Times 'Best Place to Work  2025 & 2026'. If this sounds like an environment where you would flourish, then read on… The Function  The Digital and Technology team designs, builds and maintains the systems that power Triple Point. The function enables seamless connectivity, security and innovation across the organisation, creating tools and platforms that help colleagues and partners work smarter and deliver excellent outcomes.  The Team  This role sits within Technical Operations & Cyber, within the wider Digital and Technology function. The role works closely with colleagues across D&T, our MSP, our SOC and stakeholders across the business. The team is responsible for keeping our technology secure, reliable and high performing while improving delivery pace through automation, cloud engineering and emerging technology.  The Role  We are seeking a Senior DevOps Engineer to lead hands-on DevOps and platform engineering across Triple Point’s Microsoft cloud and AI delivery landscape.  You will design, build and operate secure deployment pipelines, automation, monitoring and infrastructure-as-code patterns that enable cloud and AI workloads to move safely and at pace. As our use of Claude Code, AI agents and automation grows, this role will provide the engineering foundations to run these capabilities reliably, securely and with clear governance.  Working closely with the Head of Technical Operations & Cyber and our Senior Cyber Engineer, you will help enable pragmatic, risk-aware decisions on cloud and AI tooling, ensuring a balance between delivery pace and security, governance and operational sustainability.  This is a delivery-focused role owning engineering work end-to-end, from discovery and design through to implementation, documentation and transition into BAU. You will help remove delivery bottlenecks, strengthen platform maturity and make practical recommendations that balance pace, reliability, security and usability.  Key Responsibilities  DevOps, Cloud Platform & CI/CD Engineering  * Design, build, maintain and improve CI/CD pipelines for cloud, integration, automation and AI workloads.  * Create reusable infrastructure-as-code patterns, templates and standards for secure, consistent cloud deployments.  * Improve release management, environment management and deployment controls across development, test and production environments.  * Support source control, branching, build, test and deployment practices that help teams deliver safely and efficiently.  * Build practical engineering standards for service principals, managed identities, secrets, configuration, certificates and environment separation.    Automation, AI Enablement & Developer Experience  * Enable safe, reliable deployment and operation of Claude Code, AI agents and similar AI-assisted development tooling.  * Automate repeatable operational, deployment and monitoring tasks to reduce manual effort and improve consistency.  * Develop self-service patterns, reusable scripts and documentation that make it easier for colleagues to adopt approved engineering practices.  * Work with current and future AI Team colleagues to lay the technical foundations for agent automation and cloud-based AI delivery.  * Identify opportunities to simplify tooling, reduce friction and improve the developer and stakeholder experience.    Reliability, Monitoring & Operational Readiness  * Design and improve monitoring, logging, alerting and reporting across pipelines, platforms and cloud workloads.  * Create runbooks, deployment checklists and operational handover materials that support effective BAU ownership.  * Support incident response, root-cause analysis and continuous improvement for deployment or platform reliability issues.  * Improve resilience, recovery and performance practices for key services and automation workloads.  * Use data from monitoring and service performance to recommend improvements and prioritise platform work.    Security, Governance & Documentation  * Embed security-by-design into DevOps practices, including least privilege, secure configuration, secrets management and change control.  * Work closely with Technical Operations & Cyber, the SOC and MSP partners to ensure cloud and AI tooling is operated securely.  * Maintain clear documentation of pipeline designs, infrastructure standards, access models, monitoring arrangements and operational guardrails.  * Support audits, assurance activity and evidence gathering where DevOps, cloud or platform controls are in scope.  * Balance security, usability and delivery pace when assessing risks, trade-offs and recommendations.    Collaboration, Planning & Continuous Improvement  * Plan and prioritise DevOps improvements based on impact, value, risk and delivery needs.  * Translate technical complexity into clear recommendations for technical and non-technical stakeholders.  * Partner constructively across Digital and Technology, internal stakeholders and external technology partners.  * Challenge current ways of working where needed and recommend pragmatic improvements with clear rationale.  * Share knowledge generously and help raise DevOps capability across the function and organisation.    Knowledge & Experience  Essential  * Significant hands-on experience in DevOps, platform engineering, cloud engineering or a closely related engineering role.  * Strong experience designing and maintaining CI/CD pipelines using tools such as Azure DevOps, GitHub Actions, GitLab CI or equivalent.  * Good working knowledge of Microsoft Azure and Microsoft cloud services, including deployment, access, monitoring and governance considerations.  * Experience with infrastructure-as-code and automation tools such as Terraform, Bicep, ARM templates, PowerShell or equivalent.  * Proficiency in Python for scripting, automation and tooling able to write, read and maintain production-quality scripts, not just adapt examples.  * Working knowledge of core Azure networking concepts, including VNets, NSGs, DNS, private endpoints and load balancers, with practical experience applying these in cloud and containerised workloads.  * Strong understanding of Git, source control workflows, release management, environment management and secure software delivery practices.  * Experience implementing monitoring, logging and alerting for cloud platforms, pipelines or application workloads.  * Strong grounding in cloud security principles, including identity and access, least privilege, secrets management, network security and secure configuration.  * Awareness of cloud cost management principles, including resource tagging standards, right-sizing, and governance for spend able to recommend efficient, cost-conscious approaches rather than just functional ones.  * Ability to translate technical requirements and risk considerations into pragmatic, well-documented engineering solutions.  * Comfortable working with the Head of Technical Operations & Cyber to make pragmatic, risk-aware decisions that balance delivery pace with security and governance requirements.  * Excellent communication skills, with the ability to work effectively with technical teams, senior stakeholders and external partners.  * A self-starter mindset, with strong planning, problem-solving and ownership of delivery outcomes.    Desirable  AI & Automation  * Experience deploying, governing or operating AI-assisted development tools, agent automation or cloud-based AI workloads.  Microsoft Platform  * Experience working with Microsoft 365, Entra ID, Intune, Sentinel, Azure Monitor, Log Analytics or similar Microsoft tooling.  * Relevant certifications such as AZ-400, AZ-104, AZ-305, AZ-500, Terraform Associate, GitHub certifications or equivalent hands-on experience.  Containers & Orchestration  * Experience with containers and orchestration technologies such as Docker, Kubernetes or Azure Container Apps.  Broader Platform & Integrations  * Experience supporting Salesforce, data platform, integration or business automation workloads.  Regulated Environments  * Experience working in a regulated services environment, ideally FCA-regulated.  Why Join us?  This is a key role at the point where DevOps, cloud automation and AI capability are becoming central to how Triple Point delivers technology safely and effectively.  * You’ll join a talented, collaborative team in a connected environment where ideas and initiative are valued.  * Be part of a growing and innovative team.  * We offer a competitive salary, a comprehensive benefits package, and genuine opportunities for growth and progression.  * Opportunities for professional development and career progression.  At Triple Point, high performance means living our values every day:  * Stay Curious.  * Be Generous.  * Take Thoughtful Action.  * Pull Together.  * Own It.  In line with our values Stay Curious and Take Thoughtful Action every employee has access to AI tools.  We see technology as a co-pilot, helping us improve efficiency and insight while keeping decisions grounded in thoughtful human judgement.  Triple Point offers a wealth of benefits including a contributory pension, hybrid/flexible working and ongoing learning and development opportunities. Check out our comprehensive list of benefits HERE.  Apply today for further information! Triple Point is dedicated to providing fair and equal opportunities for all individuals, including both current and potential employees. Discrimination of any kind based on factors such as age, disability, gender, sexual orientation, pregnancy, race, ethnicity, religion, gender identity, or marital status is not tolerated by the company. Our aim is to create a welcoming and diverse work environment where people from all walks of life feel valued and supported. We actively encourage individuals from various backgrounds to apply for job vacancies and become part of our team.  STRICTLY NO AGENCIES

Copper

Since being founded in 2018, Copper has been building the standard for institutional digital asset infrastructure with a focus on custody, collateral management, and prime services. Led by Amar Kuchinad, Copper's Global CEO, the firm provides a comprehensive suite of custody, trading and settlement solutions that reduce counterparty risk and bring greater capital and operational efficiency to digital asset markets. At the heart of Copper's offering is Multi-Party Computation (MPC) technology – the gold standard in secure custody. Copper’s multi-award winning custody system is unique in that it can be connected to centralised exchanges, DeFi applications and even staking pools without the assets leaving the custody. Built on top of this state-of-the-art custody, ClearLoop is the first solution in the market that overcomes a growing industry challenge; counterparty risk with exchanges. This solution underpins a full prime services offering, connecting global exchanges, and enabling customers to trade and settle directly from the safety of their MPC-secured wallets. By reducing settlement time for transfers to a few milliseconds (without blockchain network dependency) and offering enhanced security measures, ClearLoop is rapidly reshaping the way asset managers trade and manage capital. In addition to industry-leading security certifications, Copper has one of the strongest insurance coverages in the industry from an A+ rated insurer, positioning the firm as the partner of choice for institutions seeking to safeguard their assets. Department/Team Purpose:  Copper provides institutional digital asset custody, settlement, and collateral management services across a wide range of blockchains and integrated venues. Information Security protects the firm's platforms, client assets, and regulated entities across the group. Role Purpose:  The Principal Security Architect is the senior technical authority for security architecture at Copper. The role reports to the CISO and partners closely with Engineering. The holder sets architectural direction, reviews and approves designs for major change, and acts as the firm's reference point on the security of the systems, protocols, and integrations Copper depends on. The role is predominantly architecture and assurance, with limited hands-on solution design in the cloud and integration space where reference patterns are needed. Key Responsibilities:   Architectural authority * Hold formal security sign-off authority for major changes to Copper's platforms, infrastructure, and integrations. * Shape and maintain the security architecture patterns, principles, and reference designs that engineering teams build against. * Provide the senior technical security position in architectural and business decisions, including escalations where security and delivery pressures conflict. Custody, signing, and cryptographic architecture  * Provide architectural security leadership over Copper's signing infrastructure, working alongside specialist engineering and cryptography teams. Scope covers the people, process, and operational design around MPC-based signing. Solid conceptual grounding in threshold cryptography and signature schemes is required; cryptographer-level work is not. * Review and approve changes to transaction construction, signing flows, approval policy, and key lifecycle operations. * Provide architectural assurance over chain-of-trust constructs adjacent to custody, including verifiable build pipelines, hardware-backed code signing, and authenticator-bound administrative paths. Multi-chain and integration security * Reason at architectural depth across the range of blockchains Copper supports, including EVM, UTXO, and account-based non-EVM families. This requires a working understanding of transaction construction, signing semantics, consensus assumptions, and validator and staking models across these environments, without being a protocol engineer in any of them. * Assess third-party smart contract architectures, implementations, and audit reports to a level sufficient to understand the exploit and risk surface, without performing line-by-line code review. * Review first-party integrations with partner networks, including those underpinning staking and similar on-chain participation, and form a defensible security position on the operational and contract risk Copper inherits. Settlement, collateral, and off-exchange architecture * Provide architectural ownership of the security model for Copper's settlement, collateral mirroring, and off-exchange product surfaces. * Reason about the trust boundaries between Copper, venues, and clients, and ensure architectural controls match the obligations each side carries. Identity and access architecture * Own identity and access architecture as a dedicated pillar of the role. * Set patterns for workforce, workload, and third-party identity across Entra ID, federated SSO, OAuth2 / OIDC, SAML, and modern authenticators. * Govern entitlement design, privileged access, and access models for contractors, vendors, and external operators. Cloud and platform security * Maintain working architectural fluency in both AWS and Azure, including network topology, segmentation, secrets handling, and platform telemetry. * Produce reference patterns and, where needed, direct integration designs in the cloud and platform space. Third-party and protocol risk * Lead technical security review of vendors, integrated venues, and protocols, including challenge of assurances that do not stand up to scrutiny. * Support client and counterparty due diligence on the technical content most likely to be misrepresented or under-specified. Policy, regulatory, and assurance support * Maintain a working understanding of the regulatory regimes applicable to Copper's licensed entities sufficient to translate architectural decisions into language Compliance and GRC can defend. Primary ownership of regulatory positioning sits elsewhere.  * Contribute to security policy, standards, and control framework development as the senior technical reviewer. * Participate in resilience exercises and incident reviews where architectural input materially shapes the outcome. Skills and Experience:  Essential   * Multi-chain architectural literacy. Able to reason across EVM, UTXO, and non-EVM account-based chains at the level of transaction construction, signing, consensus, and validator models. Comfortable assessing third-party smart contract designs, implementations, and audit reports for exploit and risk surface without performing code review. * Custody and signing architecture. Strong conceptual grasp of threshold signing, signature schemes, and key lifecycle. Able to design and challenge the operational architecture around signing, separation of duties, approval policy, key ceremony equivalents in MPC, and recovery, to a high standard. * Settlement and collateral architecture. Demonstrable experience reasoning about settlement, collateral, and off-exchange constructs, including trust boundaries between custodians, venues, and clients. * Identity and access architecture. Senior-level experience designing and governing identity across Entra ID, federated SSO, OAuth2 / OIDC, SAML, and modern authenticators. Comfortable with entitlement governance and third-party access design. * Cloud security. Working architectural understanding of AWS and Azure, including the ability to produce reference patterns and limited direct integration designs. * Architectural authority and judgement. Track record of holding sign-off on significant designs, taking defensible positions under uncertainty, and owning residual risk. * Change review and assurance. Comfortable reviewing the work of engineering peers, infrastructure changes, and vendor designs, and able to hold the line where it matters. * Communication. Able to operate credibly with engineers, senior business stakeholders, auditors, and regulators in the same week, without losing precision at any of them. Desirable   * Familiarity with chain-of-trust constructs including verifiable builds, reproducible build pipelines, and hardware-backed code signing. * Awareness of the regulatory landscape relevant to digital asset custody and trading (for example FCA, FINMA, FSRA / ADGM, MiCA). * Compliance familiarity across ISO 27001, SOC 2, and NIST CSF / 800-53, with the ability to map controls cleanly between them. * Enterprise architecture grounding (TOGAF, SABSA) where it complements rather than replaces technical depth. Why Copper?   At Copper, we keep innovation, openness, and curiosity at the centre of everything we do. Here, bold ideas get the spotlight, learning is constant, and diversity shapes our team from the ground up. Jump into a fast-moving, dynamic team that loves a challenge and knows how to have fun along the way. Collaboration is just as important as results—you’ll be surrounded by smart, driven colleagues in London and across our APAC, Switzerland, UAE, and US offices. Hybrid working model – we believe in the value of bringing people together and at the same time we embrace the adaptability of flexibly working. Diversity and inclusion matter to us – they’re woven into Copper life. From employee-led groups like Women at Copper to a committee focused on community and wellbeing, you’ll have a network that supports you from day one. Everyone voice matters. If you’re looking to ramp up your career, or keen to do something new in your field, with us, you’ll keep moving forward. Ready to make your mark, keep growing, and join a supportive, dynamic team? Copper’s the place. The interview process at Copper   Our interview process is designed to be thoughtful, efficient, and engaging. While specific steps may vary slightly depending on the role, the typical journey includes: 1. Initial Screening A brief conversation with our Talent Acquisition team to explore your background, motivations, and alignment with the role. 2. Technical Interview A virtual session conducted via Microsoft Teams, where you'll engage with team members to discuss relevant skills, problem-solving approaches, and technical experience. 3. In-Person Interview A conversation focused on team dynamics, collaboration style, and any final technical questions. This may be with cross-functional peers or leadership. Additional steps may be added based on the role's complexity or seniority. We aim to keep the process transparent and respectful of your time. Benefits  In return for everything you can bring to Copper, we can offer you an exciting, challenging role in a fast-growing and dynamic business, with career opportunities and welcoming working environment. Some of our key UK benefits are highlighted below:  * Paid Time Off - A minimum of 35 days of paid time off per year, inclusive of annual leave and public holidays. Employees also receive one additional day of annual leave for each year of service. * Comprehensive Medical Insurance - Inclusive of dental, optical, audiology, and mental health coverage, with medical history disregarded * Life Insurance * Enhanced Pension Contributions - Includes an enhanced employer matching contribution * 24/7 Employee Assistance Programme (EAP) If you think you have everything we're looking for and more, then we'd love you to apply for the opportunity.  Copper is an equal opportunity employer. We embrace diversity and equal opportunities in a serious way. We are committed to building a team that represents a variety of backgrounds, perspectives, and skills. The more inclusive we are, the better our work will be. So, bring us your experience, perspectives, and skills. It is in our differences that we will continue to grow and ensure Copper is transforming how institutional investors engage with digital assets. Copper is a Disability Confident Employer, please let us know if you have a disability. If you require us to provide any assistance during the recruitment process, then we would ask you to highlight this to us and we will be happy to accommodate.

Triple Point

Since 2004, we’ve been bringing investment ideas to life and connecting capital with the right people and opportunities. Today, we manage more than £2.5 billion for a broad range of investors across five key investment strategies: Private Credit, Social Housing, Clean Heat, Energy and Venture. These strategies underpin the innovative range of investments we offer to both private (retail) and institutional clients.  There are 230+ employees at Triple Point, all committed to leaving the world demonstrably better than we found it. That’s why we’re a certified B Corp, signed up to the Principles for Responsible Investment, and were named a Sunday Times 'Best Place to Work  2025 & 2026'. If this sounds like an environment where you would flourish, then read on…   The Function & Team The Digital and Technology team's purpose is to provide cutting-edge digital solutions that are safe and reliable whilst improving efficiency and reducing potential risks for everyone at Triple Point. The Digital Transformation team looks after our core systems, the integration between them, and all aspects of data, from the data warehouse to reporting that provides clear insight into trends. It automates manual business processes, adopts emerging technology such as Gen/Adaptive AI, and uses Microsoft 365 tooling to make TP and our TP'ers more efficient. It also manages our outsourced Salesforce developers and quality assurance specialists to ensure delivery quality and pace. The role As our Salesforce Solution & DevOps Architect you are a hands-on, senior member of the in-house Business Systems team - blending Salesforce solution design, day-to-day development, and, above all, ownership of our DevOps and release capability. Your primary remit is to bring deployment in-house and act as the release gate and controller for the Salesforce estate: the person who decides what ships, how and when, and who makes it safe, tested, compliant, auditable and repeatable. You work to the agreed target architecture and standards, and you set the right development, DevOps and QA frameworks and best practices for how the platform is built and released. This is a deliberately blended, hands-on role - build and configuration, solution design, DevOps and quality control - that keeps release management, QA, data and platform governance as a permanent in-house capability. The Role’s Key Responsibilities DevOps, release & quality * Own the Salesforce DevOps and release capability end to end - source control, CI/CD pipelines, environment and sandbox strategy, branching and deployment - and bring it in-house. * Act as the release gate and controller - govern what deploys and when, enforce change control and quality gates, manage deployments and rollbacks, and keep releases safe, auditable and repeatable. * Define and implement the QA approach - test strategy, automated testing (Apex and UI / regression) built into CI/CD, and quality gates at the release gate - and assure test coverage across in-house and partner delivery. * Own metadata and version-control discipline (e.g. SFDX, Metadata API and DevOps tooling such as Gearset or Copado) and continuously improve release automation and throughput. * Manage and improve change and release workflows in Jira, tying change management (ITIL) into our DevOps and CI/CD process to keep delivery controlled and efficient. Solution design & governance * Provide solution design and decisioning across Sales, Service and Experience Cloud (FSC ideal) - shaping and reviewing designs and making pragmatic day-to-day design and configuration decisions within the target architecture. * Uphold data protection, security and regulatory requirements in what is designed and released - the Salesforce data model, security and sharing, data quality, and GDPR / UK GDPR and FCA obligations. * Set and uphold development, DevOps and QA frameworks, standards and best practices, and mentor and upskill the in-house team. * Provide technical assurance over the delivery partner's build - review deployability, standards adherence, test coverage and quality, and hold delivery to account operationally. Hands-on delivery * Build and configure hands-on across the platform - declarative automation (flows), Apex and Lightning Web Components - to deliver change, automate DevOps and testing, and unblock the team. * Support incidents, change-linked fixes and access / permission work as part of a healthy, well-run platform. Experience * Strong, hands-on Salesforce development across configuration and code - flows, Apex and Lightning Web Components - including the capability to build and automate DevOps pipelines and tests. * Proven Salesforce DevOps and release engineering - source control (Git), CI/CD pipelines, SFDX / Metadata API, environment and sandbox strategy, and DevOps tooling (e.g. Gearset, Copado or Flosum). * Experience acting as a release owner / gatekeeper - change control, deployment, rollback and release quality in a controlled environment. * Test and QA engineering - test strategy, automated testing (Apex tests, UI / regression) and quality gates integrated into CI/CD and the release process. * Solution design across multiple clouds (Sales, Service and Experience Cloud), with the judgement to make and hold day-to-day design decisions (FSC preferred). * Strong data and regulatory knowledge - Salesforce data modelling and the security & sharing model, data quality, and GDPR / UK GDPR and FCA / regulatory requirements. * Setting standards and frameworks and mentoring a development team - coding and DevOps best practice, security and sharing, and technical-debt management. * Experience assuring or governing third-party / partner delivery. * Financial services / regulated-industry experience, with a good understanding of investment and lending products and their treatment (e.g. assets under management, lending, VAT, VCTs and ISAs). * Change management and Jira - hands-on experience running and improving change / release workflows in Jira, grounded in ITIL / ITSM change-management practice. Essential Qualifications & Desirable Experience  Essential qualifications * Bachelor's degree in Computer Science, Software Engineering or a related technical discipline. * Salesforce Certified Administrator, Platform Developer I and Platform App Builder. * Salesforce Development Lifecycle and Deployment Architect. * An architect-track certification - Application Architect or System Architect (or their component certifications, e.g. Data Architect and Sharing & Visibility Architect).  Desirable experience * Salesforce Platform Developer II and JavaScript Developer I - for hands-on build and DevOps automation depth. * A DevOps tooling accreditation (e.g. Gearset or Copado). * A recognised data-protection / privacy qualification (e.g. BCS Foundation Certificate in Data Protection, or IAPP CIPP/E). * Financial Services Cloud (FSC) experience. * Salesforce experience across Sales, Service and Experience Cloud in a regulated financial-services setting. What Success Looks Like Within the first year: Salesforce DevOps and release brought in-house; a working, auditable release gate with clear change control, automated test coverage and quality gates; development, DevOps and QA frameworks and standards set and consistently applied; data protection and regulatory requirements upheld in what ships; a healthy flow of hands-on delivery with the team upskilled; and the delivery partner's build assured against our release and quality standards. * Why Join us? * You’ll join a talented, collaborative team in a connected environment where ideas and initiative are valued. * Be part of a growing and innovative team * We offer a competitive salary, a comprehensive benefits package, and genuine opportunities for growth and progression. * Opportunities for professional development and career progression. At Triple Point, high performance means living our values every day: * Stay Curious. * Be Generous. * Take Thoughtful Action. * Pull Together. * Own It. In line with our values Stay Curious and Take Thoughtful Action every employee has access to AI tools. We see technology as a co-pilot, helping us improve efficiency and insight while keeping decisions grounded in thoughtful human judgement.     Triple Point offers a wealth of benefits including a contributory pension, hybrid/flexible working and ongoing learning and development opportunities. Check out our comprehensive list of benefits HERE.  Apply today for further information! Triple Point is dedicated to providing fair and equal opportunities for all individuals, including both current and potential employees. Discrimination of any kind based on factors such as age, disability, gender, sexual orientation, pregnancy, race, ethnicity, religion, gender identity, or marital status is not tolerated by the company. Our aim is to create a welcoming and diverse work environment where people from all walks of life feel valued and supported. We actively encourage individuals from various backgrounds to apply for job vacancies and become part of our team.  STRICTLY NO AGENCIES