[Hiring] Security Engineer @Pencil

Role Description

At Pencil, we are driving innovation in advertising technology through our state-of-the-art SaaS product, which harnesses Generative AI to redefine content creation. Our mission is to make AI the default in advertising without replacing creative people. To achieve this, we need to make sure that our technology isn’t just in the hands of big brands - we need to try to help small businesses and creative individuals too.

We're looking for a Security & Trust Specialist to join Pencil at a pivotal moment of growth. This is a hands-on, technical role for someone with a background in desktop support, IT systems administration or a similar technical operations role who is now building a career in security. You'll own the day-to-day security operations that keep Pencil safe — endpoints, identity and access, cloud and SaaS security — and you're happy to lend a hand with practical IT and device issues where needed. You'll work directly with our Head of Security & Trust, who will support your growth into the audit, compliance and vendor-risk side of the role over time.

• Administer and secure endpoints (MDM/Intune, patching, encryption, device compliance), and be willing to pitch in on practical desktop support and device issues when the team needs a hand.
• Own day-to-day identity and access management — joiner/mover/leaver processes, least-privilege access and quarterly access reviews across Google Workspace, Microsoft 365, GCP and other SaaS tools.
• Monitor security alerts and logs, escalate promptly, and help investigate and document security events (suspicious logins, compromised credentials, device loss, cloud misconfiguration).
• Support compliance evidence collection in Vanta for SOC 2, ISO 27001 and ISO 42001, working alongside the Head of Security & Trust rather than owning audit strategy yourself.
• Help gather evidence for vendor and customer security questionnaires, and flag anything that needs escalating.
• Identify and implement practical improvements to monitoring, alerting and access control across cloud and endpoint tooling.

Qualifications

• A background in desktop support, IT systems administration or a similar technical operations role, now moving into (or already doing blended IT/security) work.
• Hands-on experience with endpoint management (Intune or similar MDM) and Google Workspace or Microsoft 365 administration.
• Comfortable with cloud basics (GCP, AWS or Azure IAM) — you don't need deep cloud engineering experience, but you're curious and capable of learning fast.
• Some exposure to compliance or audit evidence gathering (Vanta or similar) is a bonus, not required.
• A security certification such as CompTIA Security+, ISC2 Certified in Cybersecurity or Microsoft SC-900 — or clear evidence of self-directed learning if you don't have one yet.
• A genuinely helpful, practical approach — you don't mind switching between security work and helping a colleague with their laptop.

Requirements

• You enjoy being hands-on and don't mind switching between strategic security work and practical, in-the-moment IT problems (Human).
• You're hungry to grow a career in security and want to learn from the audits and questionnaires you'll be exposed to (Owners).
• You take ownership of problems end-to-end and don't wait to be told what to do (Owners).
• You can explain technical issues simply to non-technical colleagues (Simple).

KPIs & Success Measures

• Access reviews and joiner/mover/leaver tasks completed within SLA, with zero access-control audit findings.
• Endpoint compliance rate (encryption, patching, MDM enrolment) across the device fleet.
• Time-to-close on security incidents and IT/device issues you support.
• Quality and completeness of evidence you contribute to Vanta and vendor reviews.

Benefits

• 25 days PTO plus public holidays, although we operate a Flexible Time Off scheme.
• Health insurance / private medical cover.
• Monthly stipend towards wellness, fitness, and learning and development.
• Remote - work from anywhere in your home country.
• Enhanced parental leave policies, whether you become a parent through birth, adoption or surrogacy.
• Access to our Pencil office in The Shard, London for UK employees.
• Flexible working hours.