Senior Security Engineer, Duffel

• Proven experience leading or significantly contributing to SOC 2 (Type I or II) and PCI DSS audits. You know what auditors look for and how to speak their language
• You have a software/infrastructure engineering background but have pivoted into the GRC space (or vice versa). You are comfortable reading code *and* regulatory standards
• Track record of designing and implementing security controls, not just documenting them
• Solid understanding of risk management frameworks and how to apply them pragmatically
• Ability to make trade-offs between security ideals and business realities
• Clear communication skills you can explain technical risks to non-technical stakeholders and translate compliance requirements into engineering work
• Collaborative approach: strong opinions, loosely held

Desirable

• As a Senior Security Engineer on the Foundations team, you will bridge the gap between rigorous compliance standards and modern cloud engineering. You won’t just write policies; you will architect the systems that enforce them
• You will play a pivotal role in maturing Duffel’s security posture, leading our transition into SOC 2 Type I and II certification while maintaining our PCI DSS compliance
• Take ownership of Duffel’s PCI program (the next assessment will be in June 2026) and lead the end-to-end implementation of our inaugural SOC 2 Type I and Type II certifications
• Drive compliance initiatives end-to-end: scoping, control design, implementation, evidence collection, and QSA engagement
• Develop and execute internal audit programmes; respond to external audits and customer due diligence requests
• Manage vendor security assessments and continuously improve our third-party risk processes
• Design and implement technical security controls, working directly in our infrastructure and codebase
• Partner with Engineering and Product to build data governance capabilities: data classification, access controls, audit logging, de-identification, and lifecycle management
• Contribute to our vulnerability management and incident response programmes
• Evaluate and secure vendor solutions from a technical perspective
• Shape Duffel's security policies and standards—we want your opinions on what good looks like
• Contribute to our security awareness programme and help build a strong security culture
• Partner with Legal to ensure security practices align with regulatory requirements, particularly around data privacy