SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Teya is a regulated payments fintech operating across multiple European markets, scaling toward banking-licence territory. They are rebuilding their Security Engineering function around a joint operating model with product, platform, and infrastructure teams.
You will own the application security side of this model: how software gets designed, built, reviewed, and shipped safely across a growing engineering estate, and how security functions as an accelerator rather than a bottleneck.
This is not a ticket-triage or findings-counting role. You will transform how the company builds software by converting the SDLC into a secure SDLC, placing controls where they deliver maximum value with minimum friction, and making the secure path the default path.
You will spend significant time with engineers, product managers, designers, operations, and compliance colleagues. Success means walking into any team, explaining risk in their language, and leaving them better equipped than when you arrived.
In your first 90 days, you will map real delivery paths from idea to production, establish a baseline view of the application estate's security coverage and gaps, embed with engineering teams to run threat modelling collaboratively, and identify high-leverage SDLC changes that reduce risk while accelerating delivery.
Over your first year, you will design and roll out a proportionate, evidence-based secure SDLC with controls and checkpoints; implement shift-left practices through secure defaults in templates and libraries so developers hit guardrails rarely; work with the platform team to embed policy-as-code and extend the pipeline security toolchain (SAST, SCA, secrets, DAST); scale threat modelling as routine practice through enablement and templates; build a security champions network and run training engineers actually want to attend; and move from severity labels toward exploitable attack paths that reflect real risk.
The 18-month direction is that security scales through leverage and culture, not headcount. You will build patterns, tooling, and shared understanding that other teams operate against, making security a capability the business associates with speed and confidence rather than delay.
The function is being rebuilt, so you will encounter undocumented processes, inconsistent coverage, and controls that exist on paper only. A significant portion of the application estate is behind on security review; you will close that gap through automation, culture, and ownership, not manual reviews. Cross-team relationships need repair in places; influence will be your main tool. The strategy exists on paper; delivery discipline is still being built.
Teya offers hybrid working, a competitive package, direct exposure to banking-licence-scale security work in a regulated payments environment (PCI DSS, DORA, GDPR as live constraints), and room to grow. The role is scoped as Principal with a path to management as the function grows.
REQUIREMENTS:
Hard Requirements:
- Deep application security expertise, theoretical and practical. Understand application security concepts, concerns, and risks at depth, and reason about them in unfamiliar systems.
- SDLC to SSDLC transformation experience. You have done this work, not just read about it. Know where and how to introduce security controls that deliver greatest value while accelerating developer velocity, and explain the trade-offs.
- The attacker mindset. Think like a malicious actor, recognizing real, actionable weaknesses and how they chain into genuine attacks. Go beyond noting CVE counts.
- Fundamentals over familiarity. Understand security at a fundamental level, not just which capabilities exist on a given tech stack but what controls on specific platforms actually do. Adapt to many tools and technologies.
- Communication with non-technical audiences. Take complex technical concepts and make them land with people who do not share your background, comfortably and without condescension.
- Genuine team-first instinct. Work collaboratively across teams, functions, and skillsets toward shared goals. Advise, enable, and persuade. Do not gatekeep.
Strongly Preferred:
- Penetration testing knowledge or experience (application, infrastructure, cloud, red teaming). We value the perspective, not full-time testing.
- Familiarity with regulated environments. Support compliance capabilities for PCI-DSS, ISO27001, DORA, and similar.
- Developer and engineering mindset. Practical understanding of how software is built professionally: not just scripting, but how engineering teams operate, prioritize, and ship.
- Comfort engineering solutions with Go. Go is part of the preferred technology radar; security tooling is built in the same stack.
- Practical cloud security depth. Real-world cloud security: identity, workload isolation, patterns that hold up under production pressure.
- Applied cryptography exposure. Familiarity with PKI, HSMs, or applied cryptography generally. Useful context in a payments environment.
What We Don't Need:
- Certifications in place of experience. CREST/OffSec, CISSP, CISM welcome but not what we're hiring for.
- Scanner operators. If your approach is forwarding tool output to engineering with a due date, this is not the role.
- Pure offensive-testing career path. Offensive perspective is valuable; full-time offensive work is coordinated separately.
- GRC or auditor background. GRC is a separate function.
- Security as a veto function. If your instinct is to block first and discuss later, you will find this role frustrating.
