Senior Security Engineer

Senior Security Engineer Overview

Intropic is a financial information and software business working at the frontier of global capital markets. The company combines modern cloud infrastructure and agentic AI systems with deep market knowledge to create information products used by highly sophisticated financial institutions every day. Its customers include hedge funds, proprietary trading firms, index fund managers, large asset managers, sovereign wealth funds, and investment banks, all of whom rely on these products to help generate alpha, manage risk, and make better decisions in fast-moving markets.

The company is particularly known for its Index Rebalance Forecast products and is now broadening that capability into additional strategies. Based in Canary Wharf in London and growing internationally, the team is described as fast-moving, highly accountable, and committed to strong standards of rigour and integrity.

What the role involves

This position gives you ownership of the full security function. You will be responsible for cloud security, endpoint security, detection and response, compliance, internal IT security operations, and the security of the company’s increasing use of AI agents. You will set the priorities, carry out the work, and be accountable for the outcomes.

The role is aimed at someone senior who would prefer broad ownership at a growing FinTech rather than a narrow remit inside a large organisation. The work is varied and hands-on: in a typical week you might harden an EKS cluster, refine a detection rule, plan a penetration test, and figure out how engineers can safely use coding agents.

The AI security element is a major part of the job. The company sees this as an important and still largely unsolved problem, and the successful candidate will shape the approach from the ground up.

The position also includes out-of-hours response to security alerts when necessary.

Key responsibilities

• Own and operate security engineering across the company’s cloud environments in AWS and GCP, covering everything from individual EC2 instances to a large EKS-based microservice estate.
• Run detection and response activities, including alert triage, expanding detection coverage, and making sure the tooling continues to reflect real risk.
• Take responsibility for urgent incident handling when a genuine security event occurs outside normal hours.
• Threat model new products and services before release and build security checks directly into CI/CD workflows.
• Set standards for the security of external SaaS integrations, including designing approval processes for new OAuth connections to company Google accounts.
• Secure the company’s use of AI agents such as Claude Code and Codex, as well as its production generative AI systems used internally and by clients.
• Partner with business teams to introduce controls and mitigations that reduce risk while preserving speed and productivity.
• Design and implement an automated patching approach across systems in the cloud estate.
• Own the SOC 2 programme, including the annual Type II audit, planning the yearly web application penetration test, and automating evidence collection in Drata as much as possible.
• Review existing security policies, identify where coverage is missing, and create new policies to close those gaps.
• Support onboarding and offboarding processes for employees and leavers, including automation that makes access changes quick and complete.
• Help manage a device fleet of about 100 endpoints through Jamf and Intune, with roughly 90% macOS and 10% Windows.
• Respond to colleagues’ security and IT access questions and resolve them efficiently and politely.
• Administer core SaaS platforms, including Google Workspace and GitLab, and automate repetitive administrative tasks wherever possible.

Experience and skills needed

• At least five years of experience in security across multiple domains.
• Senior-level capability; direct team leadership is not required, though it would be beneficial.
• Strong hands-on knowledge of AWS services, including EC2, S3, GuardDuty, Lambda, ECS, and EKS.
• Practical Kubernetes experience, ideally with Amazon EKS.
• Experience threat modelling web applications and responding to real security incidents.
• Familiarity with AI agents, either in your own workflow or in security tooling.
• Understanding of SOC 2 and comfort using Git.
• Working knowledge of Jamf.
• Solid scripting ability in Python or Bash, with enough skill to automate repetitive work and connect systems through APIs.
• Willingness to learn and build capability in security, IT, or GRC areas you have not previously worked in.
• Ability to switch quickly between different domains while maintaining strong attention to detail and a courteous approach to internal users.

Additional experience that would be helpful

• High-level experience with both Jamf and Intune.
• Experience securing microservice architectures or EKS clusters specifically.
• Experience using AI agents in production security workflows.
• Ability to use SQL for detection work or incident investigation.
• Experience rolling out DAST or SAST in a production setting.

Working pattern

This is a full-time role based on-site in London.

How to apply

The page includes an application link inviting candidates to apply for the job.

Degree Requirement: Not Specified

Visa Sponsorship May be