At a glance
- Employment
- Full-time
- Workplace
- Remote
- Location
- Remote · London
About Tide
- At Tide, we help SMEs save time and money in the running of their businesses by not only offering business accounts and related banking services, but also a comprehensive set of highly usable and connected administrative solutions, from invoicing to accounting.
- Tide is transforming the small business banking market and now supports over 2 million members globally across the UK, India, Germany and France.
- Using advanced technology, all solutions are designed with SMEs in mind. With quick onboarding, low fees and innovative features, we thrive on making data driven decisions to serve our mission: to help SMEs save time and money so they can get back to doing what they love.
- Tide facts:
- - Tide is available for UK, Indian, German and French SMEs
- - Over 2 million members across UK and India
About the role
- As a Principal Product Security Engineer at Tide, you will join the Product Security team consisting of application and cloud security experts.
- Your mission is to protect the products built by Tide, covering secure design reviews, threat modelling, and penetration testing.
- You will make security invisible when possible, avoiding gatekeeping in favour of enabling secure development and mentoring junior engineers.
Responsibilities
- Regularly dive deep into mobile and web app technologies to understand feature development and proactively hunt for vulnerabilities.
- Secure cloud-native applications, ensuring that security best practices are applied consistently across the cloud environment.
- Perform threat modelling and guide developers in secure design principles to prevent vulnerabilities from being introduced.
- Help remediate vulnerabilities through strategic initiatives, writing patches, or creating understandable and actionable vulnerability tickets.
- Act as the subject matter expert across a wide range of security areas, particularly in Application Security.
- Leverage automation and security tools to seamlessly integrate security into CI/CD pipelines to catch vulnerabilities early without disrupting development.
- Mentor and coach junior engineers, sharing knowledge to help raise the security bar across the organisation.
Requirements
- Have breadth and depth of knowledge across AppSec, understanding topics like private keys in the Secure Enclave, URL Schemes vs. Universal Links, presigned URLs in S3, and safe storage mechanisms for modern browsers.
- Know Burp Suite (or your favourite attack proxy) inside and out.
- Have excellent spoken and written communication skills to articulate vulnerabilities clearly and persuasively, advocating for remediation.
- Be comfortable writing proof-of-concept (POC) scripts to demonstrate findings and their potential impact.
- Have hands-on experience with securing cloud-native applications, ensuring that best practices are consistently applied.
Preferred qualifications
- Bonus points if you've written or contributed to an extension that enhances Burp Suite functionality.
- Have a blog, public speaking engagements, bug bounty profile, or a Git repository showcasing your work.
Benefits
- Competitive salary
- Group Life Insurance
- Vitality Health Insurance, with a proactive focus on mental and physical wellbeing
- 24/7 Employee Assistance Programme
- 25 days holiday with the ability to buy extra days
- £1,000 professional L&D budget per year
- Cycle to Work scheme and pension contribution via salary sacrifice
- Spacious brand-new office in Liverpool street with an all-day snacks bar
- Enhanced family-friendly leave
- 3 days for L&D or volunteering time off per year
Workplace
- Flexible workplace model supporting both in-person and remote work.
Skills
- Burp Suite
- Application Security
- Cloud Security
- Threat Modelling
- Penetration Testing
- CI/CD
