Staff Security Engineer

Join Swile as a Staff Security Engineer, where you'll play a crucial role in strengthening the security of our products, data, and engineering platform. This highly technical and hands-on position involves working closely with engineering teams to continuously harden our systems and design the next generation of our security architecture. You'll focus on both immediate security improvements and long-term privacy architecture development.

Responsibilities

• Identifying and reducing high-impact security risks across applications, APIs, and internal tools.
• Strengthening authentication, authorization, and access controls, and improving the protection of sensitive and personal data.
• Designing controls that limit the blast radius of compromised accounts, services, or infrastructure, and improving security monitoring and detection.
• We expect this person to design systems, write code, influence architecture and ship security capabilities into production.

Requirements

• You are first and foremost a strong engineer.
• You have significant experience building or securing production software and distributed systems. You are comfortable reading and writing production code, designing systems and working directly with Engineering teams.
• You have deep security engineering expertise and strong experience in several of the following areas:
• Application and Product Security
• API Security
• IAM, authentication and authorization
• OAuth2 / OIDC, WebAuthn / FIDO2
• RBAC / ABAC and privilege management
• Cloud security
• Cryptography, KMS / HSM and envelope encryption
• Tokenisation and secrets management
• Data Security and Privacy Engineering
• Threat modelling and secure software architecture

Security monitoring and detection

• You know that security engineering is a prioritisation problem.
• something that needs to be fixed this week;
• something that requires an architectural redesign;
• something cryptographically elegant but operationally unnecessary.
• You are comfortable deploying simple, high-impact controls quickly while designing stronger long-term foundations.
• highly sensitive or regulated data;
• multi-tenant architectures;
• insider risk or data-loss prevention;

Preferred

• large-scale SaaS or fintech platforms;
• advanced cryptographic or privacy-enhancing technologies.

You naturally ask

• What happens if this employee becomes malicious?
• What happens if this backend is compromised?
• What happens if someone dumps this database?

Can this endpoint be called directly?

• How much data can one account access before we notice?
• Where else does this information get replicated?

Why do we have this data at all?

You think in terms of attack paths, blast radius and least privilege, not just compliance requirements.

What success looks like

• Sensitive data is exposed to fewer systems and people.
• Access to sensitive resources is increasingly scoped, attributable and auditable.
• Compromising a single account or service has a limited blast radius.
• Security controls are increasingly enforced by the platform rather than by process.
• Product teams can build secure systems faster and with less friction.

What this role is not

• This is not primarily a GRC, SOC, compliance, policy-writing or penetration-testing role.
• Those disciplines are important, but this role exists to change how our products and systems are engineered.