Senior Security Engineer – AppSec, AI Security & Vulnerability Management

First security hire at a US fintech, building the security function from the ground up, from secure SDLC through to detection and response. - Security design and code review across engineering teams; threat modelling for new services; influencing feature designs so security is built in rather than bolted on - Hands-on web application security: review and remediation of XSS, CSRF, SSRF, injection and authorization flaws, plus browser-side controls (CSP, cookie attributes, CORS, session handling) - Built a dynamic agentic workflow for vulnerability discovery, driving agents over a codebase to find, reproduce and triage security issues, including repo-aware review in the PR pipeline - Built a platform that automates vulnerability management end to end: ingesting findings from the discovery workflow, scanners, pentests and bug bounty, judging and deduplicating them, routing each to the owning team, and verifying the fix actually closes the issue - Authored agentic skills and secure coding guidance consumed directly by AI coding agents, pushing org security standards into the agent's context at generation time - Guardrails for coding agents and LLM tooling on engineering workstations - Incident detection and response, owned end to end from detection through containment to postmortem: data leaks, malware on engineering workstations, account takeover, and phishing sites impersonating Rho (investigation and takedown) - Security observability and monitoring: security logging, alerting and detection coverage across the platform - Rolled out and scaled SAST/SCA across the codebase, tuning rules and triage to cut false positives and keep developer friction low - Defined the vulnerability management program: severity model, ownership boundaries, SLA tracking and reporting to leadership - Fraud detection and anti-abuse: browser fingerprinting and device intelligence (Castle), defences against SMS pumping and account takeover; authentication architecture covering 2FA/MFA flows, session and account recovery design

UK fintech, remote. AppSec support for engineering teams: secure code review, security guidance, architecture decisions and threat modelling (incl. Data Science projects). Incident detection and response for platform security events. Refined CI/CD security tooling (SAST, DAST) and reduced developer noise. Built a security metrics platform in Go to assess team/project security posture. Ran internal security training; implemented macOS binary signing. Architectural decisions on AWS and cryptography.

Penetration testing of web applications, thick clients, infrastructure and cloud (Kubernetes, AWS). Identified and exploited XSS, CSRF, SSRF, injection, authentication/authorization bypasses and insecure deserialization. Scoping, reporting, severity assessment and walking developers through findings and fixes.

Delivered security engineering projects end to end: automated malware analysis (evaluation and testing of sandbox solutions) and malware protection for file storage infrastructure (planning, security and performance testing, implementation). Evaluated vendor products and advised the Bank's teams on selection.

Built software for malware storage, automated malware analysis and a malware pipeline framework (Python, RabbitMQ, MinIO, Splunk). Reverse engineered malware and wrote ransomware decryptors supporting national-level incident response. Ran a Web Security workshop at SECURE 2019; designed a Kubernetes/Helm workshop platform for ENISA. Organised CTFs (ECSM 2018, ECSC 2019); built CI/CD pipelines and maintained Kubernetes deployments.

Security assessment of Tizen and Android (client-side and native application security). Code review (C/C++/Java), fuzzing (custom fuzzers, libFuzzer, AFL), reverse engineering and debugging (IDA Pro, core dumps, kernel crashes). Wrote exploits for self-discovered and external issues (e.g. dirtyc0w).