SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Thought Machine is a fintech company on a mission to modernize banking by replacing legacy technology with cloud-native core and payments systems. The company has grown to 550+ employees across offices in London, New York, Singapore, Sydney, and Lisbon, backed by £500m+ in funding from investors including JPMorgan Chase, Standard Chartered, and Temasek.
The Security Control Engineer will be a key member of Thought Machine's Security Control Engineering team, responsible for designing, implementing, and maintaining technical and operational security controls that address identified threats and risks. This role bridges security strategy with engineering execution, ensuring the company meets contractual obligations, maintains certifications (ISO 27001, ISO 22301, PCI-DSS, SOC 2 Type 2), and stays ahead of industry best practices.
Key responsibilities include:
1. Control Design & Implementation: Participate in the technical and operational design of security capabilities, tools, and procedures to mitigate security and business continuity risks. Provide domain expertise in product security, operational security, and disaster recovery planning.
2. Continuous Control Assurance: Develop and implement processes and tools for continuous audits and certification renewals. Design capabilities that satisfy ISO 27001, ISO 22301, PCI-DSS, and SOC 2 Type 2 requirements.
3. Client Support: Respond to client security inquiries, communicate technical security details, and develop materials that demonstrate Thought Machine's security posture with accuracy and sufficient technical depth.
4. ISMS & BCMS Evolution: Keep security and business continuity approaches current by incorporating new threats, technical advances, and standards. Maintain alignment with Thought Machine's evolving processes and technology stack.
The ideal candidate is a strong technical engineer who can reason about complex security problems in distributed, cloud-based, and on-premise environments. They should be comfortable with trade-offs between different security approaches and able to communicate effectively with both internal teams and external clients.
This is a full-time, permanent position based in the Lisbon office, requiring four days per week onsite.
REQUIREMENTS
Essential:
- Experience designing and implementing technical solutions to deliver security controls in cloud-based infrastructure (AWS, GCP)
- Experience working directly with software engineering teams to design technical solutions meeting security requirements
- Experience with control automation via code (Python, Go)
- Strong technical background in distributed systems, cloud security, and related technologies
- Knowledge of threat modelling for understanding threat probabilities and frequency
- Excellent communication skills; ability to translate technical/security concepts into business-relevant insights
- Ability to collaborate effectively with other departments and external stakeholders
Desirable:
- Experience in fast-paced tech or fintech environments
- Knowledge of container security, Kubernetes, Kafka, and emerging technologies
- Experience obtaining and maintaining security certifications (SOC 2, ISO 27001, PCI-DSS)
- Proficiency in leading security risk assessments, preferably with FAIR framework knowledge
