Senior Product Security Engineer

Our Story   Hello there. We’re Zopa.   We started our journey back in 2005, building the first ever peer-to-peer lending company. Fast forward to 2020 and we launched Zopa Bank. A bank that listens to what our customers don’t like about finance and does the opposite. We’re redefining what it feels like to work in finance. Our vision for a new era of banking puts people front and centre — we’ve built a business that empowers everyone to aim high, every day, to move finance forward. Find out more about our fantastic offerings at Zopa.com!    We’re incredibly proud of our achievements and none of it would be possible without the amazing team here. It’s not just industry awards we’re winning, we’ve also been named in the top three UK’s Most Loved Workplaces.    If you embrace unconventional challenges, are unafraid to think differently and are driven to make an outsized impact, you’ll thrive here at Zopa, so join us, and make it count. Want to see us in action? Follow us on Instagram @zopalife
The team: Zopa’s Product Security team ensures security is baked into our products from the very start of their lifecycles, all the way to the end. We provide the more pre-emptive, design-thinking led, less response-based side of securing the bank. If we do our job right, security becomes inherent in the design of our products, rather than something grafted on after. ​ ​ With you, we’ll be a Product Security team of 4, sitting within a larger InfoSec team of 18. Our current projects include ongoing security assessments and threat models of new, in-house systems (many AI-driven), improving our security tools - such as SAST and SCA, refining a SLSA strategy, as well as helping to maintain an external bounty program and a Vulnerability Disclosure Programme. ​ We pride ourselves in being able to collaborate and integrate seamlessly with an engineering functions. You’ll be working not only directly with your product security peers but also alongside the engineering function. Helping to design, architect and break new features and products for the bank.

A day in the life:

Being an advocate of security for product owners and engineers, with whom you'll build a working relationship.

Performing mobile, backend, and web security assessments directly

Orchestrating web, mobile, and backend security assessments

Weighing in on technical architecture discussions, ensuring security is considered from the very inception of new features

Threat modelling upcoming features, providing a more technical and hands-on steer when necessary to illustrate security concerns with proposed feature implementations

Overseeing secure engineering training programmes, keeping our engineers aware of secure engineering practices, and abreast of the common security pitfalls to avoid

Integrating security tooling, stitching together CI steps, scripts, and small tools to automate security controls and visualise their results in a helpful manner. This could include SAST, SCA, DAST, secrets scanning, vulnerability scanning, or other tooling

Being guardians of our Secure Development Lifecycle, ensuring security controls are baked in and "pushed left" as much as reasonably possible

Triaging incoming reports and findings from bug bounties, automated tools, and more

Being comfortable doing "Just-in-Time" learning around technologies and frameworks as required to understand emerging technologies in the company, and the security concerns they raise — with appropriate time allocated by the company, of course

Advising engineers on security patching, and ensuring our team does as we say by keeping our own tools patched too

Staying cognizant of the balance required between security and productivity, and how to manage stakeholder's concerns around such trade-offs

About you:

You have experience in offensive security, such as performing security assessments via tools like BurpSuite, nmap, Kali Linux, etc

Strong experience in at least web or a mobile OS, with a willingness to learn the other too

Fundamental networking and OS knowledge – you should know how to debug a failing DNS connection, comfortable with command line tools, and broader computing principles

Comfortable threat modelling, assessing the balance between features and security. Being able to explain the trade-offs to less technical stakeholders

Basic programming knowledge – we have some in-house tools we maintain ourselves alongside leveraging AI

A willingness to learn fundamental software engineering principles to ensure said tools stay maintainable, and to be confident of AI-generated results. Being confident in at least one language such as Python, JavaScript, or Go

Secure coding practices – being able to not just spot a SQL injection but provide detailed guidance about how to fix it and prevent it for future queries

Providing security advice during architectural design phases of new products. Spotting fundamental security flaws in designs early on, before code is even written

Basic cloud infrastructure knowledge, such as understanding the fundamentals of cloud compute instances (VMs), software-defined networks, and defining infrastructure in code

Added bonus:

Having experience in fintech, especially banks with mobile apps!​

Able to read common tech stack languages not commonly used in InfoSec, e.g. Java and C#. This can assist whitebox assessments

On top of knowing security skills, knowing fundamental software engineering practices to ensure modifications to our internal tools stay maintainable

#LI-JH1

At Zopa we value flexible ways of working.

We value face-to-face collaboration and a good work-life balance. This hybrid role requires you to come to our London office 2-3 days a week.

You'll also have the option of working from abroad for up to 120 days a year!* But no matter where you are, we’ll make sure you’ve got everything you need to thrive, both in your work and home life, from day one.

*Subject to having the right to work in the country of choice

 

Diversity Statement

Zopa is proud to offer a workplace free from discrimination. Diversity of experience, perspectives, and backgrounds leads to better products for our customers and a unique company culture for our people. We are made up of nearly 50 nationalities, have a DE&I forum made up of Zopians wanting to make a difference and we are proud of our culture where everyone can bring their full self to work. Our approach to DE&I is reflected in our hiring process so please let us know if you require any reasonable adjustments. 

 

Our approach to AI in interviews

At Zopa, AI isn't something we're testing out — it's part of how we work every day. As a proud partner of Jobs 2030, we're committed to building AI fluency across our workforce, and we expect Zopians to use AI as part of how they do their jobs. 

Because of that, we want to be transparent about how we think about AI use during our hiring process. 

Behavioural and competency-based interviews: please don't use AI. These conversations are designed to understand you — your experiences, your judgment, and how you've approached real situations. An AI-generated answer can't tell us that. What it can do is get in the way of us finding out whether we're the right fit for each other. 

Technical interviews: it depends on the role. Some technical stages actively welcome AI use, others don't. Your Talent Partner will let you know what's expected at each stage. Where AI is part of the assessment, we'll be interested not just in the outcome, but in how you used it – the tools you chose, your reasoning, and the decisions you made along the way.