Lead Edge Platform Security Engineer

Department: Product Mgmt - Product Promotion

Employment Type: Permanent - Full Time

Location: UK/Basingstoke, Remote

Key Responsibilities

• Own the kiosk network end to end, from on-site devices through to the secure connection back to our platform
• Maintain and improve OpenWrt and pfSense configurations, firmware and upgrade processes across a remote fleet
• Act as the escalation point for connectivity issues and turn recurring problems into permanent fixes
• Lead the evolution of how devices connect and authenticate, moving towards a modern model where each device proves its identity and requests only the access it needs
• Keep site build standards and runbooks up to date so kiosks can be deployed and supported reliably

• Build and maintain reusable GitLab CI/CD (continuous integration and delivery) pipeline templates, with security scanning built in
• Create Terraform best-practice templates and modules that the team can adopt for their own infrastructure
• Coach engineers on infrastructure-as-code, secrets handling and secure pipeline design, rather than doing it for them
• Support the team on infrastructure work outside their day-to-day expertise, and document it so it is repeatable
• Look after our self-managed GitLab instance, including routine upgrades
• Contribute to architecture decisions and write them up so the wider team understands the reasoning

• Drive our security improvement work, reporting to the CTO
• Own the annual penetration test: scoping, managing the testing firm, triaging findings and tracking fixes to closure
• Maintain a security improvement backlog across cloud infrastructure, developer tooling and the kiosk estate
• Push our hardware and firmware suppliers to improve their security: assessments, patch commitments and contractual requirements
• Set the patching and vulnerability management cadence for infrastructure and network devices
• Own certificate, key and credential lifecycles, including rotation
• Support audits and customer security due diligence with clear evidence and documentation

• Edge Network: OpenWrt and pfSense devices deployed in the field and managed remotely as a fleet
• Device Identity: Moving towards a model where devices enrol, authenticate and request access securely
• Platform Templates: Shared GitLab CI/CD and Terraform templates that make the secure way the easy way for every team
• Secure Pipelines: Security scanning and secrets handling built into how every team ships
• Penetration Testing: Running the annual test and making sure findings are fixed, not just filed
• Supplier Security: Working with hardware and firmware suppliers to raise their security standards

Skills, Knowledge & Expertise

• Hands-on experience with OpenWrt and pfSense (or OPNsense) on real hardware
• VPN technologies such as WireGuard and OpenVPN: configuration, key management and troubleshooting
• Strong TCP/IP fundamentals: subnetting, routing, DNS, DHCP, VLANs and firewall design
• Experience managing remote devices where a mistake can mean a site visit

• Writing and maintaining GitLab CI/CD pipelines, ideally including shared templates used across many projects
• Terraform: modules, remote state, state locking and safe plan/apply workflows
• Working knowledge of AWS, particularly networking and IAM (identity and access management)
• Comfortable in Linux and with scripting in shell and/or Python; familiar with administering self-hosted tools such as GitLab

• Practical involvement in penetration testing: scoping, remediation planning and re-testing
• Vulnerability management: reading advisories, scoring severity and prioritising patches
• Secrets and certificate management in production environments
• Confidence working with third parties to agree and track security improvements

• Fleet management tooling for routers or other network devices
• IoT (Internet of Things) device identity and enrolment: device certificates, zero-touch provisioning, mutual TLS
• Cellular (4G/LTE) connectivity on Linux-based devices

• Container platforms and image security scanning
• Policy-as-code or automated compliance checks in pipelines
• Centralised logging and monitoring for both cloud and remote devices

• Experience in fintech, payments or another regulated environment
• Supplier security assessment and third-party risk management
• Security certifications such as OSCP, CompTIA Security+ or CISSP (helpful, not essential)

• Passion for networks and devices: you enjoy the hands-on side as much as the automation
• Enabler, not gatekeeper: you raise the team’s capability rather than becoming a bottleneck
• Self-driven: you take the initiative on security and see improvements through without being chased
• Ownership mentality: you see problems through to a permanent fix
• Careful with change: you plan rollouts and rollbacks, whether for pipelines or for devices in the field
• Firm but constructive with suppliers: comfortable pushing vendors to meet the standard we need
• Clear communicator: able to explain risks and decisions to engineers and non-technical stakeholders alike