Lead Edge Platform Security Engineer
hace 2 días
Basingstoke
Lead Edge Platform Security Engineer Application Deadline: 2 November 2026 Department: Product Mgmt - Product Promotion Employment Type: Permanent - Full Time Location: UK/Basingstoke Reporting To: CTO Onebanx Description OneBanx OneBanx builds and runs a fintech platform that powers self-service banking kiosks. We are looking for an experienced engineer who combines DevSecOps (development, security and operations) skills with a real passion for networking and network devices. The role brings together three areas of equal importance. Edge networking: you will own and improve the network that connects our kiosks, built on OpenWrt and pfSense devices deployed in the field and managed remotely as a fleet. This calls for hands-on experience with network devices and a strong interest in how they behave in real-world conditions. DevOps enablement: our engineers already run much of their own infrastructure, so this is not about owning everything; you will set best practice, build the reusable GitLab pipeline and Terraform templates the team relies on, and support them where they need specialist help. Security: you will drive most of our security work, from annual penetration test to pushing hardware suppliers to a higher security standard. • Own the kiosk network end to end, from on-site devices through to the secure connection back to our platform, • Maintain and improve OpenWrt and pfSense configurations, firmware and upgrade processes across a remote fleet, • Act as the escalation point for connectivity issues and turn recurring problems into permanent fixes, • Lead the evolution of how devices connect and authenticate, moving towards a modern model where each device proves its identity and requests only the access it needs, • Keep site build standards and runbooks up to date so kiosks can be deployed and supported reliably, • Build and maintain reusable GitLab CI/CD (continuous integration and delivery) pipeline templates, with security scanning built in, • Create Terraform best-practice templates and modules that the team can adopt for their own infrastructure, • Coach engineers on infrastructure-as-code, secrets handling and secure pipeline design, rather than doing it for them, • Support the team on infrastructure work outside their day-to-day expertise, and document it so it is repeatable, • Look after our self-managed GitLab instance, including routine upgrades, • Contribute to architecture decisions and write them up so the wider team understands the reasoning, • Drive our security improvement work, reporting to the CTO, • Own the annual penetration test: scoping, managing the testing firm, triaging findings and tracking fixes to closure, • Maintain a security improvement backlog across cloud infrastructure, developer tooling and the kiosk estate, • Push our hardware and firmware suppliers to improve their security: assessments, patch commitments and contractual requirements, • Set the patching and vulnerability management cadence for infrastructure and network devices, • Own certificate, key and credential lifecycles, including rotation, • Support audits and customer security due diligence with clear evidence and documentation A flavour of the problems this role will tackle: • Edge Network: OpenWrt and pfSense devices deployed in the field and managed remotely as a fleet, • Device Identity: Moving towards a model where devices enrol, authenticate and request access securely, • Platform Templates: Shared GitLab CI/CD and Terraform templates that make the secure way the easy way for every team, • Secure Pipelines: Security scanning and secrets handling built into how every team ships, • Penetration Testing: Running the annual test and making sure findings are fixed, not just filed, • Supplier Security: Working with hardware and firmware suppliers to raise their security standards Education Level: BSc Computer Science, IT or software engineering related qualification (desirable) We do not expect one person to be an expert in everything below; we do expect hands-on experience in each area, and real depth in at least one. • OpenWrt, • pfSense, • WireGuard / OpenVPN, • GitLab CI/CD, • Terraform, • AWS, • Linux / Shell / Python, • Secrets & Certificate Mgmt, • Penetration Testing, • Vulnerability Management, • Supplier Security, • Network Security, • Hands-on experience with OpenWrt and pfSense (or OPNsense) on real hardware, • VPN technologies such as WireGuard and OpenVPN: configuration, key management and troubleshooting, • Strong TCP/IP fundamentals: subnetting, routing, DNS, DHCP, VLANs and firewall design, • Experience managing remote devices where a mistake can mean a site visit, • Writing and maintaining GitLab CI/CD pipelines, ideally including shared templates used across many projects, • Terraform: modules, remote state, state locking and safe plan/apply workflows, • Working knowledge of AWS, particularly networking and IAM (identity and access management), • Comfortable in Linux and with scripting in shell and/or Python; familiar with administering self-hosted tools such as GitLab, • Practical involvement in penetration testing: scoping, remediation planning and re-testing, • Vulnerability management: reading advisories, scoring severity and prioritising patches, • Secrets and certificate management in production environments, • Confidence working with third parties to agree and track security improvements The following are not required but will distinguish exceptional candidates: • Fleet management tooling for routers or other network devices, • IoT (Internet of Things) device identity and enrolment: device certificates, zero-touch provisioning, mutual TLS, • Cellular (4G/LTE) connectivity on Linux-based devices, • Container platforms and image security scanning, • Policy-as-code or automated compliance checks in pipelines, • Centralised logging and monitoring for both cloud and remote devices, • Experience in fintech, payments or another regulated environment, • Supplier security assessment and third-party risk management, • Security certifications such as OSCP, CompTIA Security+ or CISSP (helpful, not essential) Beyond technical credentials, we value engineers who embody the following: • Passion for networks and devices: you enjoy the hands-on side as much as the automation, • Enabler, not gatekeeper: you raise the team's capability rather than becoming a bottleneck, • Self-driven: you take the initiative on security and see improvements through without being chased, • Ownership mentality: you see problems through to a permanent fix, • Careful with change: you plan rollouts and rollbacks, whether for pipelines or for devices in the field, • Firm but constructive with suppliers: comfortable pushing vendors to meet the standard we need, • Clear communicator: able to explain risks and decisions to engineers and non-technical stakeholders alike #J-18808-Ljbffr
Chef y Cocinero
Camareros
Personal de Bar
Venta Minorista
Ayudante de Cocina
Comida Rápida
Agricultura
Almacén
Arte, Medios de Comunicación, Diseño
Azafato y Azafata
Construcción y Obras
Contabilidad y Finanzas
Cuidado de niños
Deportes y Bienestar
Educación
Entretenimiento
Estética y Belleza
Eventos y Promociones
Gerencia
Industria y Producción
Ingenieria
Limpieza
Moda
Oficina y Administración
Redacción y Edición
Salud y Servicios Sociales
Seguridad
Servicio al Cliente
Servicios Jurídicos
Tecnología de la información
Trabajos en línea
Transporte y Reparto
Ventas y Marketing
Otros