Application Security Engineer

Thought Machine

Thought Machine's mission is bold – to properly and permanently rid the world's banks of legacy technology. To achieve this, we have developed the foundations of modern banking through core and payments technology which run natively in the cloud. What we are attempting is hard and means we need great people working together to build great technology. We have grown rapidly in the past few years – growing our team to more than 550 individuals across offices in London, New York, Singapore, Sydney and our newly established Engineering Hub in Lisbon. We have raised more than £500m in funding and our investors include Molten Ventures, Eurazeo, Intesa Sanpaolo, Temasek, Nyca Partners, JPMorgan Chase Strategic Investments, Standard Chartered Ventures, and more. We have created a culture that enables our team to produce the best work in the industry while ensuring we have fun along the way. We're regularly cited as having a fantastic workplace culture and have been recognised by Sifted magazine as having one of the highest Glassdoor ratings for a UK fintech company and the industry's most generous employee share package. Named one of the world's most innovative fintechs by Global Finance Magazine, we were also recognised by the Financial Times as one of Europe's fastest-growing companies for two consecutive years—and a UK Best Employer for 2026. This is a full-time, permanent position based in our Lisbon office, requiring four days a week onsite. This position plays a key role in ensuring Thought Machine teams are taking all required steps in building a secure product set. You will play a major and leading role in protecting Thought Machine product against security risks, with influence to implement cutting-edge measures to minimise exposures and vulnerabilities. Whether engineering a system to address a technical security hurdle, protecting our customers' data, or consulting on a wide range of security topics, you are empowered to engage and lead cross-functionally. A large part of Thought Machine product security function is a greenfield challenge, we are building the bank of tomorrow with cutting edge web technology, no best-practice/of the shelve security frameworks or tools can solve our security challenge. We are building the best security to enable engineering and impress financial service auditors. Key qualities of the ideal candidate would have experience in OWASP top 10 vulns, devsecOps, data privacy protection, passion to mentor and enable devs, creativity, autonomy, ability to work and complete multiple projects simultaneously. DUTIES * Drive improvements to Thought Machines product security posture through strategic planning and collaboration with both development and infrastructure teams, with trust, autonomy and influence. * Produce production web scale grade application security design. * Review and produce data privacy and financial regulatory functional and nonfunctional designs. * Perform design reviews and Threat modeling of Thought Machine services and products. * Perform vulnerability assessments and security testing. * Providing subject matter expertise on all areas of security and privacy throughout the Software Development lifecycle. * Liaison with development teams for design, code reviews & education. * To contribute to security strategy, security tooling selection and creation. * Conduct regular security assessments and code reviews. REQUIREMENTS Essential * Expertise with a programming language (e.g. Python, Go or Java) * Experience of security in a DevOps environment * Experience in web application penetration testing and security tooling (e.g. Burp proxy, Web/Network Scanners, Static code analysers, etc). * Coding experience for automating/integrating security tools and creation of security tools. * Knowledge of security in distributed systems at scale. * Cloud and containers technology knowledge (e.g. AWS, GCP, Kuberbetes, Docker) * Experience of performing security design reviews, threat modelling and risk assessments * Knowledge of application security issues Desirable * Professional security qualifications are desirable (e.g. CISSP, Offensive Security, Sans Institute, etc.) * Contributions to the security community (public research, blogging, presentations, etc) * Awareness and experience of the Data Protection Act, ISO 27001 and PCI-DSS Benefits * Highly competitive salary * Voluntary Pension Plan (match up to 5%) * Private Healthcare Insurance * Comprehensive Life Insurance * 25 days holiday plus public holidays * Two charity days a year * Daily Meal Allowance * Access to outstanding learning materials and courses * Sports and hobby clubs, subsidised by Thought Machine * All the latest tech you need * Huge range of healthy (and not-so-healthy) snacks, smoothies and drinks * A talented and experienced team as your colleagues * An environment where we encourage learning and progress We actively hire candidates who demonstrate technical excellence in their field and welcome people of all ages and backgrounds, providing everyone with equal access to professional development. You are encouraged to apply even if your experience doesn't accurately match the job description. We also encourage applications from those with different abilities, including candidates with ADHD, autism, dyslexia or dyspraxia.

Thought Machine

Thought Machine's mission is bold – to properly and permanently rid the world's banks of legacy technology. To achieve this, we have developed the foundations of modern banking through core and payments technology which run natively in the cloud. What we are attempting is hard and means we need great people working together to build great technology. We have grown rapidly in the past few years – growing our team to more than 550 individuals across offices in London, New York, Singapore, Sydney and our newly established Engineering Hub in Lisbon. We have raised more than £500m in funding and our investors include Molten Ventures, Eurazeo, Intesa Sanpaolo, Temasek, Nyca Partners, JPMorgan Chase Strategic Investments, Standard Chartered Ventures, and more. We have created a culture that enables our team to produce the best work in the industry while ensuring we have fun along the way. We're regularly cited as having a fantastic workplace culture and have been recognised by Sifted magazine as having one of the highest Glassdoor ratings for a UK fintech company and the industry's most generous employee share package. Named one of the world's most innovative fintechs by Global Finance Magazine, we were also recognised by the Financial Times as one of Europe's fastest-growing companies for two consecutive years—and a UK Best Employer for 2026. This is a full-time, permanent position based in our Lisbon office, requiring four days a week onsite. A Cloud Security Engineer is a contributor to the larger Security Engineering team. We desire engineers who are able to think creatively engineer, design, and build solutions to security problems. We have a passion for exploration of unique solutions and sharing of unique perspectives that you can bring to the team and its work. The Security Engineering team is cross-functional and made up of diverse people who bring their own unique expertise in either (or both) application security and infrastructure (cloud) security. We allow team members to move from project to project, subject to subject based on their skills, experience, and interests. Each team member brings their own expertise to bear in ways that are collaborative and designed to find the best solutions to complex problems. The team covers the following areas, and individuals contribute to any of them based on their own expertise: * Designs and reviews to build a secure product and platform * Threat modelling to identify relevant areas of focus * Define the best in class protective and detective security controls * Development of security tooling and automation * Implement and maintain cutting-edge tools and measures A large part of the Thought Machine security function is greenfield; we are building the bank of tomorrow with cutting edge technology. To achieve this we need innovative thinking to create security solutions in our products and our infrastructure. We look for people who think outside the box, and outside of traditional silos to find unique solutions and approaches to security that lead the industry. DUTIES * Provide security expertise and mentorship to Thought Machine engineering teams through the stages of planning, design, and testing of new solutions. * Co-develop threat models with engineering teams that identify relevant threats and relevant strategies for mitigation * Design and build cloud native preventative and detective controls that operate at scale * Build and maintain automation to actively audit and assess infrastructure-as-code and in-place infrastructure * Develop (in code) security tooling, contribute to third-party security products, and develop updates for existing tooling that is in use in our environment * Work with cloud engineering and operations teams to develop tooling that maintains our secure operating state in production * Perform security reviews and security testing * Contribute to the overall security strategy, security tooling selection and creation * Operate collaboratively with other Thought Machine teams with trust and influence REQUIREMENTS Essential * Familiarity with building and deploying containerised applications in public cloud using CI/CD frameworks and infrastructure automation * Knowledge of cloud networking architecture, cloud operations, security, automation and orchestration * Familiarity with performing security threat modelling and design reviews * Knowledge of security in distributed systems * Familiarity with good security practices with containers and Kubernetes * Experience with languages such as Go, Python, or other modern programming languages * Coding experience in the creation, automation, and integration of security tools * Experience in version control systems such as Git * Experience with designing, developing, and maintaining security in public cloud environments such as AWS and GCP * Strong interpersonal and communication skills to support collaboration with other personnel and teams Desirable * Existing experience building and operating distributed systems at scale * Awareness and experience with “well-architected” cloud security frameworks or CSA-CCM * Contributions to the security community (public research, blogging, presentations, etc) * Experience in performing web application penetration testing and security tooling * Experience developing tools and interacting with cloud provider APIs. Benefits * Highly competitive salary * Voluntary Pension Plan (match up to 5%) * Private Healthcare Insurance * Comprehensive Life Insurance * 25 days holiday plus public holidays * Two charity days a year * Daily Meal Allowance * Access to outstanding learning materials and courses * Sports and hobby clubs, subsidised by Thought Machine * All the latest tech you need * Huge range of healthy (and not-so-healthy) snacks, smoothies and drinks * A talented and experienced team as your colleagues * An environment where we encourage learning and progress We actively hire candidates who demonstrate technical excellence in their field and welcome people of all ages and backgrounds, providing everyone with equal access to professional development. You are encouraged to apply even if your experience doesn't accurately match the job description. We also encourage applications from those with different abilities, including candidates with ADHD, autism, dyslexia or dyspraxia.

Thought Machine

Thought Machine's mission is bold – to properly and permanently rid the world's banks of legacy technology. To achieve this, we have developed the foundations of modern banking through core and payments technology which run natively in the cloud. What we are attempting is hard and means we need great people working together to build great technology. We have grown rapidly in the past few years – growing our team to more than 550 individuals across offices in London, New York, Singapore, Sydney and our newly established Engineering Hub in Lisbon. We have raised more than £500m in funding and our investors include Molten Ventures, Eurazeo, Intesa Sanpaolo, Temasek, Nyca Partners, JPMorgan Chase Strategic Investments, Standard Chartered Ventures, and more. We have created a culture that enables our team to produce the best work in the industry while ensuring we have fun along the way. We're regularly cited as having a fantastic workplace culture and have been recognised by Sifted magazine as having one of the highest Glassdoor ratings for a UK fintech company and the industry's most generous employee share package. Named one of the world's most innovative fintechs by Global Finance Magazine, we were also recognised by the Financial Times as one of Europe's fastest-growing companies for two consecutive years—and a UK Best Employer for 2026. This is a full-time, permanent position based in our Lisbon office, requiring four days a week onsite. A Senior Cloud Security Engineer is a part of the larger Security Engineering team. We desire engineers who are able to lead the engineering, design, and delivery of solutions to security problems. We have a passion for exploring unique solutions and sharing differing perspectives that leads to the development of leading solutions to complex security problems. The Security Engineering team is cross-functional and made up of diverse people who bring their own unique expertise in either (or both) application security and infrastructure (cloud) security. We allow team members to move from project to project, subject to subject based on their skills, experience, and interests. Each team member brings their own expertise to bear in ways that are collaborative and designed to find the best solutions to complex problems. The team covers the following areas, and individuals contribute to any of them based on their own expertise: * Designs of secure products and platforms * Reviews of engineering designs, threat models, and coding practices * Threat modelling to identify relevant areas of focus * Define the best in class protective and detective security controls * Development of security tooling and automation * Implement and maintain cutting-edge tools and measures A large part of the Thought Machine security function is greenfield; we are building the bank of tomorrow with cutting edge technology. To achieve this we need innovative thinking to create security solutions in our products and our infrastructure. We look for people who think outside the box, and outside of traditional silos to find unique solutions and approaches to security that lead the industry. DUTIES * Provide security expertise and mentorship to Thought Machine engineering teams through the stages of planning, design, and testing of new solutions. * Lead the design and delivery of cloud native preventative and detective controls that operate at scale * Build and maintain automation to actively audit and assess infrastructure-as-code and in-place infrastructure * Develop (in code) security tooling, contribute to third-party security products, and develop updates for existing tooling that is in use in our environment * Co-develop threat models with engineering teams that identify relevant threats and relevant strategies for mitigation * Work with cloud engineering and operations teams to develop tooling that maintains our secure operating state in production * Perform security reviews and security testing * Lead complex projects to develop security capabilities, tooling, and functionality. * Contribute to the overall security strategy, security tooling selection and creation * Operate collaboratively with other Thought Machine teams with trust and influence REQUIREMENTS Essential * Familiarity with building and deploying containerised applications in public cloud using CI/CD frameworks and infrastructure automation * Knowledge of cloud networking architecture, cloud operations, security, automation and orchestration * Familiarity with performing security threat modelling and design reviews * Knowledge of security in distributed systems * Familiarity with good security practices with containers and Kubernetes * Experience with languages such as Go, Python, or other modern programming languages * Coding experience in the creation, automation, and integration of security tools * Experience in version control systems such as Git * Experience with designing, developing, and maintaining security in public cloud environments such as AWS and GCP * Ability to lead and encourage good design skills including creative and critical thinking, collaboration, full evaluation of options, and objective decision making to find a preferred solution. * Strong interpersonal and communication skills to support collaboration with other personnel and teams Desirable * Existing experience building and operating distributed systems at scale * Awareness and experience with “well-architected” cloud security frameworks or CSA-CCM * Contributions to the security community (public research, blogging, presentations, etc) * Experience in performing penetration testing and security testing * Experience developing tools and interacting with cloud provider API Benefits * Highly competitive salary * Voluntary Pension Plan (match up to 5%) * Private Healthcare Insurance * Comprehensive Life Insurance * 25 days holiday plus public holidays * Two charity days a year * Daily Meal Allowance * Access to outstanding learning materials and courses * Sports and hobby clubs, subsidised by Thought Machine * All the latest tech you need * Huge range of healthy (and not-so-healthy) snacks, smoothies and drinks * A talented and experienced team as your colleagues * An environment where we encourage learning and progress We actively hire candidates who demonstrate technical excellence in their field and welcome people of all ages and backgrounds, providing everyone with equal access to professional development. You are encouraged to apply even if your experience doesn't accurately match the job description. We also encourage applications from those with different abilities, including candidates with ADHD, autism, dyslexia or dyspraxia.