Senior Security Engineer

Department Purpose

We aim to achieve a balance between corporate culture and start-up culture, and at the same time be close to product solutions. Therefore, we divide our department into small self-sufficient teams that can make decisions on their own. This applies to all stages of product production: from conceptualisation to architecture, to build, to release, to iteration and support.   

Team Purpose

Copper’s Information Security department keep the business’ systems and network resources secure and protect the company, employees, and client data. The Infrastructure Security team focuses on providing objective oversight and validation of Copper’s infrastructure security controls and processes.

Role Purpose

As a Senior Security Engineer, you will play a key role in strengthening Copper's security posture through the design, implementation, and continuous improvement of security controls, identity services, cloud security solutions, and governance processes.

Working closely with technology, infrastructure, and business teams, you will lead initiatives to protect Copper's systems, data, and digital assets. You will be responsible for enhancing our security capabilities across identity and access management, cloud platforms, endpoint security, vulnerability management, automation, and security monitoring, ensuring security controls remain effective, scalable, and aligned to business and regulatory requirements.

This is a hands-on technical role requiring strong security engineering expertise, a proactive approach to risk reduction, and the ability to influence security best practices across the organisation.

Key Responsibilities:   

Identity and Access Management (IAM)

• Design, implement, and maintain Identity and Access Management (IAM) solutions, including Microsoft Entra ID, Entra Identity Governance, AWS IAM Identity Centre, and supporting authentication and authorisation services.
• Manage permission settings and access controls to ensure secure and efficient user access to company resources.

Security Systems Configuration and Analysis

• Ensure security systems are configured according to specified requirements and industry best practices.
• Assess security configurations across cloud and endpoint platforms, benchmark controls against CIS, STIG, SOC2, and internal security standards, and drive remediation activities to improve security posture.

Security Solution Inventory and Maintenance

• Own the administration, configuration, and lifecycle management of security platforms across cloud, endpoint, identity, and network domains.
• Maintain accurate inventories of security tooling and integrations.
• Evaluate new technologies and recommend enhancements to improve security effectiveness and operational efficiency.
• Partner with vendors and internal stakeholders to troubleshoot issues and maximise platform value.

Security Practices and Technical Advice

• Act as a trusted security advisor to technical teams, business stakeholders, and senior leadership, providing guidance on security architecture, risk reduction, and regulatory compliance.
• Provide technical advice on security measures and potential enhancements.
• Create or update policies and procedures to align with industry regulations and best practices.

Security Risk Management

• Manage vulnerability management activities across cloud infrastructure, endpoints, SaaS applications, and identity platforms using tools such as Wiz, Microsoft Defender, and ArmorCode.
• Prioritise and coordinate remediation efforts based on business impact, exploitability, and risk exposure.
• Conduct security assessments and threat modelling exercises for new projects and technologies.
• Ensure security controls align with SOC2, ISO27001, CIS Controls, and organisational risk management requirements.
• Produce reports and metrics demonstrating security posture, control effectiveness, and remediation progress.

Scripting and Automation

• Develop and maintain automation solutions using PowerShell, Python, Bash, and APIs to improve operational efficiency and reduce manual effort.
• Design, implement, and support Infrastructure as Code (IaC) solutions using Terraform and cloud-native tooling.
• Integrate security telemetry into SIEM platforms such as Microsoft Sentinel to improve threat detection and monitoring capabilities.
• Develop automated controls and workflows to enhance governance, compliance, and incident response processes.

Skills and Experience:  

Essential   

• Microsoft Entra ID / Identity Governance: Extensive experience administering Microsoft Entra ID, including Conditional Access, Identity Protection, Privileged Identity Management (PIM), Entitlement Management, Access Reviews, Lifecycle Workflows, and application integrations. Experience of implementing governance controls within hybrid Microsoft and AWS environments.
• AWS Security: Experience securing AWS environments using services such as IAM, Security Hub, GuardDuty, CloudTrail, Config, AWS Organizations, Route 53, and Key Management Service (KMS).
• Microsoft 365 and Azure Security: Strong experience with Microsoft security technologies including Microsoft Defender XDR, Microsoft Sentinel, Microsoft Purview, Intune, Entra ID, Azure Security services, and Information Protection capabilities.
• Scripting and Automation: Demonstrated ability in using scripting languages like PowerShell, Bash, and Python to automate security tasks, streamline processes, and enhance system efficiencies.
• System and Application Hardening: Skilled in the assessment and hardening of operating systems and SaaS applications, adhering to CIS and STIG standards. This includes a comprehensive understanding of the best practices in system security and the application of these practices to ensure robust defence against cyber threats.
• SaaS Security: Experience securing and administering SaaS platforms through SSO, SCIM provisioning, Conditional Access, entitlement governance, and lifecycle management.
• Endpoint Security: Experience managing endpoint security solutions across Windows and macOS environments, including EDR, device hardening, application control, and compliance monitoring.
• Network Perimeter Security - Experience securing enterprise networks using firewalls, Web Application Firewalls (WAF), Secure Web Gateways (SWG), Zero Trust Network Access (ZTNA), DNS security solutions, and cloud-native network controls.

Desirable   

• Secure Web Gateway Management: Experience in configuring and managing Secure Web Gateways, such as Zscaler, iBoss, and Netskope, to protect against web-based threats and enforce company security policies.
• Binary Execution Control: Experience with solutions like AppLocker, Defender Application Control, Santa, ThreatLocker across both Mac and Windows endpoints

Why Copper?   

At Copper, we keep innovation, openness, and curiosity at the centre of everything we do. Here, bold ideas get the spotlight, learning is constant, and diversity shapes our team from the ground up. 

Jump into a fast-moving, dynamic team that loves a challenge and knows how to have fun along the way. Collaboration is just as important as results—you’ll be surrounded by smart, driven colleagues in London and across our APAC, Switzerland, UAE, and US offices. 

Hybrid working model – we believe in the value of bringing people together and at the same time we embrace the adaptability of flexibly working. 

Diversity and inclusion matter to us – they’re woven into Copper life. From employee-led groups like Women at Copper to a committee focused on community and wellbeing, you’ll have a network that supports you from day one. Everyone voice matters.  

If you’re looking to ramp up your career, or keen to do something new in your field, with us, you’ll keep moving forward. 

Ready to make your mark, keep growing, and join a supportive, dynamic team? Copper’s the place. 

The interview process at Copper   

Our interview process is designed to be thoughtful, efficient, and engaging. While specific steps may vary slightly depending on the role, the typical journey includes: 

1. Initial Screening A brief conversation with our Talent Acquisition team to explore your background, motivations, and alignment with the role.
2. Technical Interview A virtual session conducted via Microsoft Teams, where you'll engage with team members to discuss relevant skills, problem-solving approaches, and technical experience.
3. In-Person Interview A conversation focused on team dynamics, collaboration style, and any final technical questions. This may be with cross-functional peers or leadership. 

Additional steps may be added based on the role's complexity or seniority. We aim to keep the process transparent and respectful of your time. 

Benefits  

In return for everything you can bring to Copper, we can offer you an exciting, challenging role in a fast-growing and dynamic business, with career opportunities and welcoming working environment. Some of our key (Enter Location here) benefits are highlighted below: 

In return for everything you can bring to Copper, we can offer you an exciting, challenging role in a fast-growing and dynamic business, with career opportunities and welcoming working environment. Some of our key UK benefits are highlighted below:  

• Paid Time Off - A minimum of 35 days of paid time off per year, inclusive of annual leave and public holidays. Employees also receive one additional day of annual leave for each year of service. 

• Comprehensive Medical Insurance - Inclusive of dental, optical, audiology, and mental health coverage, with medical history disregarded 

• Life Insurance 

• Enhanced Pension Contributions - Includes an enhanced employer matching contribution 
• 24/7 Employee Assistance Programme (EAP) 

If you think you have everything we're looking for and more, then we'd love you to apply for the opportunity.  

If you think you have everything we're looking for and more, then we'd love you to apply for the opportunity.