SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Teya is a regulated payments fintech operating across multiple European markets, scaling toward banking-licence territory. They are rebuilding their Security Engineering function around a joint operating model with product, platform, and infrastructure teams.
You will own the application security side of this model: how software gets designed, built, reviewed, and shipped safely across a growing engineering estate. This is not a review-queue or ticket-triage role. Instead, you will transform how the company builds software by embedding security into the SDLC as an accelerator rather than a toll gate.
In your first 90 days, you will map real delivery paths across teams, establish a baseline view of the application estate's security coverage and gaps, embed with engineering teams to run threat modelling collaboratively, and identify high-leverage controls that reduce risk while accelerating delivery.
Over your first year, you will design and roll out a secure SDLC with proportionate, evidence-based controls; shift security left by building secure defaults into templates and libraries; work with the platform team to embed policy-as-code and pipeline security tooling (SAST, SCA, secrets, DAST); scale threat modelling through enablement and templates; build a security champions network and run training engineers want to attend; and move risk assessment from severity labels toward exploitable attack paths.
The 18-month direction is clear: security scales through leverage and culture, not headcount. You will build patterns, tooling, and shared understanding that other teams operate against, making security a capability the business associates with speed and confidence.
The team operates out-of-band and non-blocking, embedding in the pipeline rather than sitting in the critical path. Security is framed as an enabler. Application owners own their app's security posture; you provide patterns, tooling, and verification. Work is automated first—if you do something manually more than twice, you automate it or hand it back. All work happens in the open with visible backlogs and logged decisions.
You should expect to find undocumented processes, inconsistent coverage, and controls that exist on paper only. A significant portion of the application estate is behind on security review; the strategy is to close gaps through automation, culture, and ownership, not manual reviews. Cross-team relationships need repair in places, and influence will be your main tool.
The role offers direct exposure to banking-licence-scale security work in a regulated payments environment, with PCI DSS, DORA, and GDPR as live constraints. There is a path to management as the function grows. Hybrid working with a competitive package.
REQUIREMENTS
Hard Requirements:
- Deep application security expertise, both theoretical and practical. You understand application security concepts, concerns, and risks at depth and can reason about them in unfamiliar systems.
- SDLC to SSDLC transformation experience. You have done this work, not just read about it. You know where and how to introduce security controls that deliver the greatest value while accelerating developer velocity.
- The attacker mindset. You can think like a malicious actor, recognizing real, actionable weaknesses and how they chain together into genuine attacks—beyond noting CVE counts.
- Fundamentals over familiarity. You understand security at a fundamental level and can adapt to many tools and technologies. We don't care if you know a particular product; we care that you understand what controls actually do.
- Communication with non-technical audiences. You can take complex technical concepts and make them land with people who don't share your background, comfortably and without condescension.
- A genuine team-first instinct. You work collaboratively across teams, functions, and skillsets. You advise, enable, and persuade; you do not gatekeep.
Strongly Preferred:
- Penetration testing knowledge or experience (application, infrastructure, cloud, red teaming). We value the perspective it gives you.
- Familiarity with operating in a regulated environment (PCI-DSS, ISO27001, DORA).
- A developer and engineering mindset. Practical understanding of how software is built professionally and how engineering teams operate, prioritize, and ship.
- Comfort engineering solutions with Go. Go is part of the preferred technology radar.
- Practical cloud security depth. Real-world cloud security practice: identity, workload isolation, production patterns.
- Applied cryptography exposure. Familiarity with PKI, HSMs, or applied cryptography in a payments environment.
Not Required:
- Certifications (CREST, OffSec, CISSP, CISM) in place of experience.
- Scanner operator experience or forwarding tool output with due dates.
- A pure offensive-testing career path.
- A GRC or auditor background.
- Security as a veto function.
