Every firm we work with checks how we handle its data before it lets us near it. Today the engineers who build the product also run the infrastructure and answer the security questions. You would own the platform and the controls behind those answers, as the first person whose whole job is this.
Why this role, why now
Seisa holds a firm’s most confidential material: deal memos, data rooms, partner email. What we tell a firm’s security team has to be true and backed by evidence, and this is the role that makes it so. It is the seat we most need to fill.
What you will do
The GCP platform
Cloud Run, Cloud Tasks and Pub/Sub, Vertex AI, Secret Manager and KMS, Cloud Storage and Cloud Build, brought under Terraform.
Neo4j, Postgres on Supabase and Langfuse: backups, restore drills, and isolation between firms.
Staging and production fully separate, and promotion from one to the other uneventful.
Identity and access
Least-privilege IAM, SSO and MFA everywhere, access reviews, secret rotation and offboarding.
Connectors
Microsoft 365 and the other sources we read handling tokens, scopes and permissions safely.
Compliance
The controls behind our SOC 2 and ISO 27001 work in Vanta, with the auditor and pen-test firm you choose and manage.
Security answers
The security pack, the questionnaires firms send, and the calls where their CTO wants to talk to someone technical.
Observability and incidents
Monitoring and incident response that fit a small team.
What we look for
- You have run production infrastructure on a major cloud, GCP ideally, Azure or AWS welcome, and written the infrastructure as code for it.
- You have been the person who got a SOC 2 or ISO 27001 audit through at a startup or scale-up, and can name the controls you owned and the evidence you produced.
- You are comfortable in Python and a CI pipeline, and will read and change application code, not only configuration.
- You would rather answer “Partial” with a plan than tick “Yes” on something that is not true.
- Probably five to twelve years in, though we care about what you have owned more than the number.
Nice to have: Neo4j or Postgres operations, Entra ID and Microsoft Graph, multi-tenant SaaS, a GCP or Azure security certification.
What it is not
Not a compliance‑writing role: Vanta handles most of the paperwork, and the gap is engineering. Not round‑clock on‑call for a large estate, and not a security operations centre. Pen tests and audit sign‑off are bought in; you choose and manage them.
The first 90 days, roughly
- 01 Terraform for the GCP estate, IAM and secrets cleaned up, and staging and production fully separate.
- 02 Technical controls green in Vanta, and a pen test booked.
- 03 A security pack we can send the same week a firm asks for it.
Stack
GCP, Neo4j, Postgres on Supabase, Langfuse, Python, Vanta.
How we hire
- 01
Intro
30 minutes, a call
What you have built, what you want next, and what Seisa is.
- 02
Technical
1 hour, in Paddington
A review of the access setup on a slice of our real platform, and how you would answer a firm’s security questionnaire.
- 03
Half-day build
With the team
Half a day working with the team on a real piece of the platform.
#J-18808-Ljbffr
