Cybersecurity Engineer

The problem.

Everything this firm is worth is either in a private repository or behind a venue credential. There is no physical trading floor to protect and no customer data to lose. The threat model is narrow and severe: source code exfiltration, credential theft, and a supply-chain compromise that arrives through a dependency nobody read.

What you would do.

• Own the threat model and keep it honest, including the parts that implicate how we currently work.
• Secure the development path: dependency review, build provenance, signing, and the boundary between machines that research and machines that trade.
• Own identity, access and secrets: who can reach what, for how long, and how that is revoked in minutes.
• Keep the isolation real. The public site, the recruiting inbox, the research environment and the live environment are separate, with no shared credential and no network path between them.
• Run detection and response for a firm with no security operations centre. That means detection a small number of people can actually act on.

What we would want evidence of.

• You have secured a small organisation where you were the security function.
• You have handled a real incident, and can describe what you changed afterwards.
• You take supply-chain risk seriously in practice, not only in a policy.
• You can say no to a convenient integration and explain the exposure it would create.
• You are pragmatic about where the risk actually is rather than exhaustive about where it could be.

What would make this a bad fit.

This role is a poor fit if you want a team, a budget and an existing tooling estate. None of it is here yet.

This role is a poor fit if compliance frameworks are how you measure security. The measure here is whether a specific attack would work.