Abound

Security Engineer

• Own the recurring security assurance cycle end to end
• Run third-party security due diligence, supplier tiering, reassessments, registers, concentration-risk tracking, and exit plans
• Own responses to inbound security due diligence from funders, banking partners, investors, commercial partners, and prospects
• Build and maintain a reusable security trust pack and standard questionnaire pre-fills
• Maintain the annual security assurance calendar and ensure activities produce evidence and close actions
• Coordinate external penetration tests from scoping through remediation and retesting
• Facilitate tabletop exercises and track post-exercise actions
• Maintain the information security risk register and administer policy exceptions and risk acceptances
• Perform first-line control testing and retain evidence
• Produce security management information for the Head of Security, ExCo, and Risk Committee
• Consolidate and manage vulnerabilities and security findings from EDR, cloud security posture, SAST/DAST/SCA, secrets scanning, and penetration tests
• Triage findings, coordinate remediation with engineering teams, escalate ageing findings, and report remediation performance
• Run security awareness activities, phishing simulations, role-based training, and completion tracking
• Coordinate pre-employment screening with People
• Contribute to the ISO 27001 ISMS, including control documentation, Statement of Applicability, evidence collection, internal audits, and external auditor liaison
• Draft, review, approve, and maintain security policies and standards
• Maintain incident response plans and playbooks, facilitate post-incident reviews, track remediation, and support regulatory notifications
• Maintain business continuity and disaster recovery documentation and testing evidence
• Embed security requirements into the SDLC and support threat modelling
• Support RoPA maintenance, DPIA completion, and DSAR handling with Legal

GRC Security Specialist