Senior Security Engineer (London, Hybrid)

Location: London Office/Hybrid (1–2 days on site)
Schedule: Full-Time

 

The Role 

Most security roles protect data. This one protects evidence. Asset Reality builds mission-critical infrastructure for clients in law enforcement and government, operating in environments where records are examined adversarially and the stakes are high. 

You will join a small engineering team as a working engineer with deep security expertise. This is not an advisory role and it is not a governance role. You will ship production code alongside the rest of the team — Go services, Postgres, React, all on AWS — and you will be the person who makes sure that what we ship stands up to adversarial scrutiny. 

Security here is not a separate function reviewing the team's work from the outside. It is a discipline embedded in how the team designs, builds, and operates the product. You will set the standard for that.

 

Responsibilities

• Contribute to day-to-day product development as a senior engineer: designing, writing, reviewing, and shipping production code in Go and React.

• Own the security dimension of engineering work: lead threat modelling on new features and architectural changes, drive secure design decisions, and review high-risk changes.

• Own and improve the security of our AWS estate: IAM design, network segmentation, secrets management, and data isolation in a multi-tenant system.

• Build security into the development lifecycle: dependency and vulnerability management, CI/CD security controls, static and dynamic analysis, and the tooling that makes the secure path the easy path.

• Design and build product security features where the domain demands them: audit integrity, tamper evidence, access controls, and data isolation.

• Lead the technical side of incident response: detection, investigation, and remediation, and the exercises that keep us ready.

• Support client-facing security work with technical depth: contribute to security questionnaires, due diligence responses, and client assessments where engineering answers are needed.

• Raise the security literacy of the wider team through design reviews, pairing, and pragmatic internal guidance — not policy documents.

 

Essential Experience

• Five or more years as a software engineer, with substantial time spent in security-focused work — whether as a security engineer, a product engineer who owned security, or something in between. You are comfortable being measured as an engineer first. 

• Strong backend development experience. Go strongly preferred; deep experience in a comparable language with willingness to work in Go is acceptable. 

• Demonstrable, hands-on ownership of cloud security in a production AWS environment. You should be able to reason about IAM design, network segmentation, secrets management, and data isolation in a multi-tenant system without reaching for a reference. 

• Threat modelling as a practised discipline rather than an occasional exercise — and the ability to run it with engineers who haven't done it before. 

• Practical experience with application security: you can find, exploit, and fix the vulnerabilities that matter in a web application backed by a relational database, and you know which ones don't matter. 

• Comfort working in a small team where you will be the security depth, without a larger security function behind you.

 

Desirable 

• Experience in a domain with irreversible, high-value transactions: digital asset custody, payments infrastructure, finance, or similar. 

• Frontend experience with React, or enough to be dangerous in code review. 

• Experience supporting a formal security or compliance regime from the engineering side — SOC 2 Type II, ISO 27001, or a government assurance framework. 

• Detection and response tooling experience, particularly building or operating it rather than just buying it. 

• Experience as the first or only security-focused engineer somewhere. 

• Postgres depth: schema design, row-level security, performance under audit-heavy workloads.