Principal Security Engineer (AppSec)

Hello. We're Teya.

Teya was founded on a simple belief: local businesses deserve better.

They are the cafés, restaurants, salons, shops and entrepreneurs that bring character to our high streets, create jobs and keep communities moving. Yet for too long, financial services has made life harder for them - with clunky tools, poor support and complexity that gets in the way of running a business.

Teya exists to change that.

We're building a financial platform for local businesses across Europe - one built around simple tools, thoughtful design and real human support. Our Members rely on us to help them run their business with confidence, and that responsibility shapes the way we work.

We move fast. We care about quality. We stay close to the detail. And we believe great performance and genuine hospitality should go hand in hand.

If you want to build meaningful products, solve real problems and make a genuine difference for local businesses, we'd love to hear from you

About the role We're a regulated payments fintech operating across multiple European markets, scaling into banking-licence territory. Security Engineering is being rebuilt around a joint operating model with our product, platform, and infrastructure teams. We're hiring a Principal Security Engineer to own the application security side of that model: how software gets designed, built, reviewed, and shipped safely across a growing engineering estate, and how security shows up as an accelerator rather than a toll gate.

This is not a review-queue role, and it is not a role about counting findings. We're not looking for someone to triage scanner output, chase "critical" CVE counts, or sign off tickets. We want an engineer who changes how the company builds software: transforming our SDLC into a secure SDLC, placing controls where they deliver the most value for the least friction, and making the secure path the default path.

The thread running through everything here is influence. You will spend as much time with engineers, product managers, designers, operations, and compliance colleagues as you do with code and tooling. The person who succeeds in this role is the person who can walk into any team, explain the risk in language that team actually uses, and leave them better equipped than when they arrived.

What you'll work on First 90 days

• Understand how we actually build. Map our real delivery paths, from idea to production, across the teams that matter most. Find where security currently lands too late, too heavily, or not at all.
• Baseline the application estate. Establish a clear, honest view of coverage, risk, and the gaps between them. We would rather know the truth early than have a tidy dashboard.
• Start building relationships. Embed with engineering teams, run threat modelling with them rather than for them, and use those sessions to demonstrate what good looks like in practice.
• Identify high-leverage controls. Identify what changes to the SDLC would measurably reduce risk while making delivery faster.

First year

• Secure SDLC transformation. Design and roll out the controls, patterns, and checkpoints that make up our SSDLC. Proportionate, evidence-based, and justified by impact, not by convention.
• Shift-left in practice, not as a slogan. Secure defaults in templates, libraries, and paved roads so that the easiest way to build something is also the safe way. Developers should hit guardrails rarely, and understand them when they do.
• Pipeline-embedded controls. Work with the platform team to extend policy-as-code and build upon existing pipeline security toolchain (SAST, SCA, secrets, or DAST for example). Checks that run in the pipeline and produce signal engineers trust, not noise they learn to ignore.
• Threat modelling as routine practice. Make design-stage security a normal part of how teams work, scaled through enablement and templates rather than through your calendar.
• Security champions and enablement. Build a champions network, run training that engineers actually want to attend, and create the material that lets teams self-serve on the common questions.
• Risk that reflects reality. Move us from severity labels towards exploitable attack paths: what an attacker could actually chain together in our environment, and what that would cost us.

The 18-month direction The strategy is that security scales through leverage and culture, not headcount. Your job is to build the patterns, tooling, and shared understanding that other teams operate against, and to make security a capability the business associates with speed and confidence rather than delay. If a control needs to be applied a hundred times, you build the way it applies itself, and you make sure the hundred teams understand why it exists.

What you'll bring Hard requirements

• Deep application security expertise, theoretical and practical. You understand application security concepts, concerns, and risks at depth, and you can reason about them in unfamiliar systems rather than only in the ones you've seen before.
• SDLC to SSDLC transformation experience. You've done this work, not just read about it. You know where and how to introduce security controls and steps that deliver the greatest value or impact while simultaneously accelerating developer velocity, and you can explain the trade-offs you chose and why.
• The attacker mindset. You can think like a malicious actor: recognising real, actionable weaknesses and how they chain together into a genuine attack. This goes well beyond noting that a system is affected by x number of "critical" CVEs.
• Fundamentals over familiarity. You understand security at a fundamental level, not just which capabilities exist on a given technology stack but what the controls on that specific platform, service, or tool actually do. We don't care whether you know a particular product. We care that you know enough to adapt to many, or any, tools and technologies to harden security posture.
• Communication with non-technical audiences. You can take a complex technical concept and make it land with people who do not share your background, and you can do it comfortably and without condescension.
• A genuine team-first instinct. You have worked, and want to work, collaboratively across teams, functions, and skillsets towards a shared goal. You advise, enable, and persuade. You do not gatekeep.

Strongly preferred

• Penetration testing knowledge or experience. Application, infrastructure and cloud, red teaming, and beyond. We're interested in the perspective it gives you, not in you running tests full time.
• Familiarity with operating in a regulated environment. We are a regulated financial institution, and you would be supporting our compliance capabilities to maintain alignment with PCI-DSS, ISO27001, DORA, and many more.
• A developer and engineering mindset. A practical understanding of how software is built in a professional environment: not just the ability to write a script to achieve small tasks, but how engineering teams actually operate, prioritise, and ship.
• Comfort engineering solutions with Go. Go is a part of our preferred technology radar and we build our security tooling in the same stack.
• Practical cloud security depth. Real-world cloud security practice: identity, workload isolation, and the patterns that hold up under production pressure.
• Applied cryptography exposure. Familiarity with the management or operation of PKI and HSMs, or applied cryptography more generally. Useful context in a payments environment.

What we don't need

• Certifications in place of experience. CREST/OffSec, CISSP, CISM, and equivalents are welcome but not what we're hiring for.
• Scanner operators. If your approach to application security is forwarding tool output to engineering teams with a due date attached, this is not the role.
• A pure offensive-testing career path. Offensive perspective is valuable here; full-time offensive work is coordinated separately.
• A GRC or auditor background. GRC is a separate function, and we work closely with it.
• Security as a veto function. If your instinct is to block first and discuss later, you will find this role frustrating and the teams here unreceptive.

How the team works

• Out-of-band, non-blocking. We embed in the pipeline, we do not sit in the critical path.
• Security is an enabler. We make the case for security in terms of delivery speed, resilience, and customer trust, and we expect to be held to it.
• Skin in the game is shared. Application owners own their app's security posture. We provide the patterns, tooling, and verification.
• Automation first. If you're doing something manually more than twice, you automate it or you hand it back to the owning team.
• Public requests, not DMs. All work in the open. Backlog visible. Decisions logged.
• Ways of working matter. Defined split between roadmap, keep-the-lights-on, and unplanned work. We push back on unplanned demand with reasons.

Straight talk

• The function is being rebuilt. You will find undocumented processes, inconsistent coverage, and controls that exist on paper only. Fixing these is part of the role, not a surprise.
. click apply for full job details