Security Engineer in City of London

At GetGround, our mission is to make property investment safer, faster and more accessible for everyone. We’ve built an all-in-one property investment platform that supports investors from opportunity analysis and company formation through to financing, accounting and portfolio management. By bringing software, data and specialist services into one experience, we make property investing simpler, clearer and more cost-effective.

More than 30,000 investors across 70 countries trust us with their identity documents, company records, bank details and the financial picture of their portfolios. Several of our products are regulated by the FCA, and we’re now serving institutional clients and expanding into new markets.

Our security needs to grow faster than we do. We’re looking for someone to own it.

You’ll be GetGround’s first dedicated security engineer. This is a hands‑on role with broad ownership. You’ll decide how we prevent, detect and respond to threats across our cloud, devices, identity and SaaS estate, and then build it.

The scope goes beyond configuring tools. You’ll run our SIEM and own our alerts, keep us ahead of a threat landscape that AI is changing fast, and make sure leadership knows where we stand and what we need.

You’ll work closely with our site reliability engineer, product engineers, our Compliance team and our Data Protection Officer. Over time, you’ll be able to shape how security works across GetGround, including the standards, processes and future hires we need.

What you’ll do

• Own our security posture. You’ll be the person accountable for security at GetGround. Assess where we are today and define a roadmap that balances security with what the business needs. Be pragmatic: understand our stage, what risk we can accept for now and what has to be fixed today. Keep leadership informed about our risks, what you need and how we’ll address them.
• Stay ahead of threats. The threat landscape is moving faster than ever, and AI is driving much of that change. Track what’s emerging, judge what matters to a regulated fintech and act before it reaches us.
• Run our SIEM and own our alerts. Make sure logs from GCP, identity, endpoints, SaaS tools and our own platform reach the SIEM and stay there. Write detection rules, map coverage against MITRE ATT&CK, tune out the noise and make sure nothing important goes unnoticed.
• Automate response. Build playbooks that contain common threats as soon as an alert fires. Lead incident response when things go wrong, and make sure we learn from it.
• Protect the data we hold. Know where sensitive data lives, who can access it and when it moves. Secure every channel it passes through: devices through endpoint detection and response (EDR) and anti‑malware monitoring and protection, email and cloud storage through data loss prevention, and our platform and tools through access controls.
• Work across the business. Partner with our site reliability engineer and product engineers on secure infrastructure and design, and with Compliance on our obligations. Assess vendors and run training people actually remember.
• Set our policies and back them with working controls. Build and keep updating our security policies, best practices and information security management system (ISMS). Implement and automate the technical controls behind our security certifications and frameworks, such as ISO 27001.

What you bring

• Hands‑on detection and response experience. You’ve run a SIEM, built detection rules and owned alerting in production.
• A habit of staying current. You follow how attackers are using AI and other new techniques.
• Cloud security depth. You understand cloud infrastructure, identity and networking well enough to harden them, ideally on GCP.
• Endpoint and identity experience. You’ve run EDR, anti‑malware and identity tooling across a company’s devices and SaaS estate.
• An automation‑first mindset. You’d rather automate a control or a response than do it by hand.
• Judgement about risk. You can separate a real threat from a theoretical one, prioritise accordingly and explain the trade‑off to people who aren’t specialists.
• Ownership and clear communication. You take responsibility for outcomes, surface problems early and tell leadership plainly what you need.

Bonus

• Experience in fintech, financial services or another FCA‑regulated environment.
• Experience implementing controls for security certifications such as ISO 27001.
• Experience with SOAR tooling and infrastructure as code, such as Terraform.
• Experience securing AI systems or LLM‑based products.
• Experience as the first or only security hire at a startup or scale‑up.
• Experience with UK GDPR or working alongside a Data Protection Officer.
• Experience with identity and zero‑trust controls, such as SSO, phishing‑resistant MFA and conditional access.
• Experience running penetration tests, red‑team exercises or a bug bounty programme.

This role isn’t for you if

• You want to stay in one specialism.
• You’re comfortable with alerts nobody reads.
• You see security as the department of no.
• You want a fully defined programme to execute.
• You don’t connect with how we work.

Why join

• Own security for a platform trusted with sensitive financial data by more than 30,000 investors.
• Build our security function from the ground up as we expand internationally.
• Work on challenging problems across cloud infrastructure, customer data, AI and regulated services.
• Competitive salary and meaningful equity.
• Hybrid London working, with three days per week in Waterloo.
• Benefits include private health and dental cover, a learning budget, a home‑office setup budget and 12 mental health days per year.

Diversity & inclusion at GetGround: We encourage applications from all sections of society and we believe in the criticality of an inclusive culture. We are committed to equal employment opportunity regardless of race, religion or belief, ethnic or national origin, disability, age, citizenship, marital, domestic or civil partnership status, sexual orientation, gender identity or any other basis as protected by law.

42% of our employees identify as female or non‑specified, 58% as male. 22 nationalities represented across offices in 5 countries.

Our work on Design Accessibility: Inclusion is at the heart of our culture - we celebrate and reflect on key D&I and cultural events such as: Black History Month, International Women’s Day and Pride.