[Hiring] Security and Compliance Engineer @Griffin

Role Description

We're looking for an Engineer 1.5 to become the engineering voice of security, compliance and assurance at Griffin. Sitting across engineering, security, risk and operational resilience, you'll turn standards and regulatory expectations into practical controls that engineers actually want to use and you’ll build those controls yourself, shipping code to production alongside the engineering team. You’ll also give our second and third lines real confidence in what we’ve built. It’s a rare hybrid role with broad ownership and a direct hand in strengthening Griffin’s security.

What Success Looks Like

• In your first 6 months, you'll have taken ownership of our certification, attestation and audit work including ISO 27001 and SWIFT, with evidence organised and findings driven through to closure.
• Our engineering risks and controls will be well maintained, and our release, change and post-incident processes will be stronger.
• You’ll have shipped code that automates control checks and evidence collection, and you’ll be a regular contributor to our codebase.
• By month 12, our resilience plans, including Important Business Service technical mapping, B& Continuity Planning and disaster recovery, will be current.
• Security and compliance will be easier to run and demonstrate to customers, thanks to clearer ownership and smart automation.

To Do This You’ll Own

• Control design and cyber security governance: translating standards into practical engineering controls and building and shipping the code that puts them in place, working with Engineering teams to get them live.
• Certifications and attestations, from SWIFT and FPS today to schemes like SOC 2 and ISO 27001 in the future, including the documentation behind them.
• Internal and external audits and customer due diligence requests, owning findings and driving them to closure.
• Engineering Risk and Controls Self Assessments, controls and actions, plus recurring control activity such as chaos testing and backup/restore.
• Code release and change management, improving the process and sampling releases to check adherence to policy.
• Post-incident reviews, including follow-up actions and sharing learnings with the right stakeholders.
• Engineering's contribution to operational resilience (DR plans and IBS technical mapping) and to managing engineering third parties alongside Operations.

Your Background

• A hands-on engineering or technical background, including experience writing and shipping production code with an engineering-first approach to turning standards into practical controls and technical delivery.
• Experience in security, compliance, risk or assurance within a technical environment, including owning or significantly contributing to audits, certifications or attestations.
• Strong knowledge of compliance, risk and cyber security principles, and a broad understanding of change and release management, incident management, operational resilience and third-party governance.
• Sharp analytical and assurance skills: spotting gaps, assessing adherence to standards and following actions through.
• Stakeholder management and influencing skills across Engineering, SMEs, auditors and control functions, with a pragmatic, proportionate approach to governance.
• A love of writing - we have a major amount of written documentation that you will be contributing to, and we place a high degree of importance on clarity and readability.

Ideally, You Would Also

• Be familiar with frameworks such as SOC 2, ISO 27001, SWIFT and FPS, ideally from a regulated fintech or challenger bank environment.
• Have used automation and code to improve security, compliance or control processes and documentation.

Benefits

• Remote-first flexibility: Work from anywhere in the UK.
• Work from abroad: Up to 20 days a year.
• Time off: 25 days’ holiday, bank holidays and a winter break (we shut down between Christmas and New Year).
• Share options: Own a part of what we’re building together.
• Pension: Auto-enrolment into our Penfold scheme.
• Insurance: Private medical with Bupa (including family cover) and life insurance with AIG.
• Wellbeing: 1:1 coaching and therapy session available through Oliva.
• Family leave: Enhanced parental leave with up to 6 months on full pay after two years’ service.
• AI tools: Everyone has a Claude subscription on us and access to other premium tools.
• Your setup: We’ll support you in creating a comfortable and effective WFH environment.