Principal Security Engineer (AppSec)

The role

You will own the application security side of a joint operating model. You will transform the SDLC into a secure SDLC by designing controls, patterns, and checkpoints that integrate into the engineering estate.

What you will do

• Map real delivery paths from idea to production
• Baseline the application estate to establish coverage and risk views
• Embed with engineering teams and run threat modelling
• Identify high-leverage controls to reduce risk and increase delivery speed
• Design and roll out SSDLC controls, patterns, and checkpoints
• Implement shift-left security through secure defaults in templates and libraries
• Work with the platform team to extend policy-as-code and pipeline security toolchain
• Build a security champions network and run training
• Move from severity labels towards exploitable attack paths
• Build patterns, tooling, and shared understanding to scale security through leverage

Required qualifications

• Deep application security expertise, theoretical and practical
• SDLC to SSDLC transformation experience
• The attacker mindset
• Understanding of security at a fundamental level
• Communication with non-technical audiences
• A genuine team-first instinct

Nice to have

• Penetration testing knowledge or experience
• Familiarity with operating in a regulated environment
• A developer and engineering mindset
• Comfort engineering solutions with Go
• Practical cloud security depth
• Applied cryptography exposure

Benefits

• Hybrid working
• Competitive package
• Room to grow into management as the function grows

About the company

Teya is a financial platform for local businesses across Europe. They build simple tools and thoughtful design to help entrepreneurs run their businesses with confidence.