kaluza - AppSec Staff Engineer
Requirements
• Ideally, you’ll have: • Extensive experience mentoring engineers and collaborating closely (e.g. pairing, swarming) • Deep understanding of software security flaws and web application security best practice (OWASP Top 10, CWE/SANS Top 25) • Extensive knowledge of CI/CD and DevOps principles, and their security considerations • Experience applying AI in your own work and helping others build it safely into how they develop • Scripting skills and first-hand experience of software development at scale • Working knowledge of Okta or equivalent, to enable workforce identity and enforce access management policies • Awareness of AWS and/or GCP security best practice, and some experience with infrastructure as code (e.g. Terraform) • Experience applying architectural and software design patterns in a complex environment • You’ll also be: • A pragmatic, risk-based decision-maker who weighs the technical and commercial consequences of your choices • Skilled at influencing upwards and outwards, with great communication skills • Able to set a clear vision for large-scale technical direction and align multiple teams behind it • Keen to drive compliance and NFR improvements that balance information security and commercial goals • Committed to a culture of learning and improvement, and willing to challenge engineering leadership to support it • Skills (SFIA): We use the SFIA framework https://sfia-online.org to assess and develop our security engineers. Levels run from 1 to 7. • Level 6: Systems design https://sfia-online.org/en/sfia-9/skills/systems-design • Level 5: Information security https://sfia-online.org/en/sfia-9/skills/information-security, specialist advice https://sfia-online.org/en/sfia-9/skills/specialist-advice, systems development lifecycle https://sfia-online.org/en/sfia-9/skills/systems-software-lifecycle-engineering, solution architecture https://sfia-online.org/en/sfia-9/skills/solution-architecture, emerging technology monitoring https://sfia-online.org/en/sfia-9/skills/emerging-technology-monitoring • Level 4: Information assurance https://sfia-online.org/en/sfia-9/skills/information-assurance, information and data compliance https://sfia-online.org/en/sfia-9/skills/information-and-data-compliance • Desirable: Identity and access management https://sfia-online.org/en/sfia-9/skills/identity-and-access-management (Level 5), software development https://sfia-online.org/en/sfia-9/skills/programming-software-development (Level 6), learning delivery https://sfia-online.org/en/sfia-9/skills/learning-delivery (Level 3), and information assurance https://sfia-online.org/en/sfia-9/skills/information-assurance stepping up to Level 5 • Five values guide how we work at Kaluza: • Play to win: Collective pride in decarbonising energy at scale. • Solve the real problem: Cutting through complexity to focus on real-world outcomes. • Build trust every day: Consistency, transparency and doing what we say. • Own the outcome: Full accountability, wins and setbacks, without ego. • Go further together: Collaboration, respect and different perspectives.
Responsibilities
• You’ll join the Security Engineering team, working alongside our cyber security leadership, architecture team and technical leaders across engineering. Our mission is to equip teams to build and innovate while upholding security best practice and protecting client data in the highly regulated energy sector. • Integrate security tooling and use AI to prevent, detect and respond to emerging threats • Work with senior technical leadership to shape our technical strategy and solutions architecture, so security, risk and compliance feed into technical decisions • Help product teams deliver secure systems quickly by building a strong security culture through mentoring, design reviews and training • Give product and engineering teams practical guidance on identifying, prioritising and mitigating systemic risks and vulnerabilities • Lead the evolution of our security best practice across application development and the wider SDLC, supporting teams with expert advice and automation • Influence technical and non-technical stakeholders across Kaluza and client teams • Mentor and coach security and software engineers to balance risk with speed and quality • Build relationships with third-party security vendors and industry bodies to keep us at the forefront of emerging practices, tooling and standards
Benefits
• Time off and family: 26 days’ holiday [plus/including bank holidays], plus 26 weeks’ full pay for new parents with no qualifying service period • Health and security: Private medical insurance with virtual GP, life assurance, pension scheme, free mortgage advice and eye tests • Pay and flexibility: Discretionary bonus, a Flex Fund of 5% [of salary] to spend on the benefits you want most, retail discounts through Perks at Work • Growth and setup: Personal learning budget, home office budget • Climate: Furthr, our climate action app • Come as you are • We want to meet people from all walks of life. The more inclusive we are, the better our work will be, and we recognise talent on merit and potential. If you’re excited about the role but don’t tick every box, we’d still love to hear from you. If you need any adjustments during the process, just let us know. • Find out more on our careers page https://www.kaluza.com/careers/ and LinkedIn https://www.linkedin.com/company/kaluza/, or read our Applicant Data Protection Policy https://www.kaluza.com/applicant-data-protection-notice/.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT