Principal Security Engineer (AppSec)

Overview

As Principal Security Engineer at Teya, you will lead the secure design, build, and shipping of software across a growing engineering estate. You’ll shape an SSDLC that adds security with minimal friction, partnering with product, platform, and engineering teams. Your work will turn security into an enabler for fast delivery, not a gate, by embedding security into the SDLC and elevating risk language to non-technical audiences. You’ll drive risk-based improvements and enablement initiatives that scale across the organization. This role offers the chance to impact security at banking-licence scale within a mission-driven fintech for local businesses.

Pay / Benefits

• Hybrid working
• competitive package
• growth opportunities
• inclusive and equal-opportunity employer
• support for reasonable adjustments
• room to grow within the role

Responsibilities

• Own application security within the joint operating model across product, platform, and infrastructure teams
• Design and roll out SSDLC controls, patterns, and checkpoints based on impact and value
• Embed with engineering teams, run threat modelling with them, and demonstrate best practices in practice
• Identify high-leverage controls to reduce risk while accelerating delivery
• Build patterns, tooling, and shared understanding that other teams operate against
• Develop security champions and enablement material to enable self-serve security
• Shift from severity labels to exploitable attack-path risk modeling
• Collaborate with platform team to extend policy-as-code and pipeline security toolchain (SAST, SCA, secrets, DAST)
• Make security a tangible part of delivery speed, resilience, and customer trust

Key requirements

• Deep application security expertise spanning theory and practice
• Proven experience transforming SDLC to SSDLC with value-delivery and velocity impact
• Attacker mindset with ability to reason about weaknesses and exploit chains
• Fundamental understanding of security controls across platforms, services, and tools
• Excellent communication skills to explain risk to non-technical audiences
• Genuine team-first mindset and ability to influence across functions
• Strong collaboration and enablement skills without gatekeeping

• Strong communication with non-technical audiences
• Team-first mindset and collaboration
• Influence and enablement across cross-functional teams
• Threat modelling
• Secure SDLC transformation
• Policy-as-code

…