Senior Security Engineer

We re looking for an experienced Security Engineer to help design, implement, and operate security across our infrastructure, applications, networks, and isolated computing environments. This is a hands-on technical role covering identity and access management, cryptography, secrets management, endpoint security, secure software delivery, and on-premises infrastructure. You ll work across connected environments, client-site data centres, and air-gapped systems where security, reliability, and operational discipline are essential. What you ll do: * Design and manage identity and access controls, including SSO, MFA, federation, privileged access, and machine identities. * Configure and operate Keycloak or an equivalent self-hosted identity provider. * Manage secrets, certificates, public key infrastructure (PKI), certificate authorities, and cryptographic keys, including secure key ceremonies. * Secure Linux systems, networks, endpoints, and on-premises infrastructure. * Implement security controls for air-gapped environments, including controlled data transfers, offline updates, and network segmentation. * Secure self-hosted source control and CI/CD pipelines, ideally GitLab Self-Managed, including secrets scanning, dependency management, and artifact signing. * Support network security across multiple sites, including firewalls, IPsec tunnels, VPNs, reverse proxies, and access controls. * Operate vulnerability management, security monitoring, incident response, and infrastructure hardening processes. * Maintain technical documentation, security configurations, operational runbooks, and audit evidence. Nice to have: * Experience operating an offline root CA and personally participating in or leading a formal key ceremony. * Hands-on experience with hardware security modules (HSMs). * Experience with MDM, endpoint detection and response (EDR), and zero-trust security. * Experience in defence, government, financial services, or critical infrastructure. * Familiarity with ISO 27001, SOC 2, or NIST security frameworks. * Experience with on-premises Kubernetes and container security. What we re looking for: * At least 5 years of hands-on experience in security engineering, infrastructure security, or a closely related technical security role. * Practical experience with identity and access management, ideally Keycloak, including OIDC, SAML, SSO, federation, and MFA. * Experience with PKI, certificate lifecycle management, cryptographic keys, and secrets management platforms such as HashiCorp Vault or OpenBao. * Strong Linux, networking, and infrastructure security fundamentals. * Experience securing on-premises environments, data centres, or isolated/air-gapped networks. * Understanding of network segmentation, VPN/IPsec, firewalls, and secure remote access. * Experience with source control and CI/CD security, preferably GitLab Self-Managed. * Ability to automate security tasks using Bash, Python, Ansible, Terraform, or similar tools. * Experience with security monitoring, vulnerability remediation, and incident response. * Strong problem-solving skills, attention to detail, and the ability to document and explain technical decisions.