Senior Security Engineer Crypto

As a Senior Security Engineer at Teya, you will rebuild security engineering around a joint operating model with platform and infrastructure teams at a regulated payments fintech scaling across multiple European markets. You'll own specific gaps in current coverage: payment cryptography operations on cloud-hosted HSM services, application security at scale, and pipeline-embedded controls that let the rest of the company move fast without security becoming a bottleneck. This is a hands-on role for an engineer who builds production systems, not a review-queue position.

What you'll do

• Design, implement, and continuously improve a Secure SDLC integrated from design through production
• Embed security into planning and delivery via threat modelling, security requirements, and automated controls
• Lead application security reviews for new systems, major features, and high-risk changes across web, API, mobile, and backend services
• Define and maintain secure architecture patterns for authentication, authorisation, APIs, data protection, and multi-tenant isolation
• Own the application security tooling stack (SAST, DAST, SCA), integrating it into CI/CD with high-signal, low-noise outputs
• Partner with engineers to triage and remediate vulnerabilities based on exploitability, impact, and regulatory risk
• Work with Security Operations to improve application-level logging, telemetry, and incident response readiness
• Act as a trusted advisor to engineering teams, raising the bar through practical guidance, documentation, and targeted training

What you bring

• 5+ years in security engineering with a demonstrable track record of shipping platforms, not just performing reviews or writing policy
• Production Go experience: you are comfortable designing, writing, testing, and shipping production Go services, as our platform is Go-native and we build security tooling in the same stack
• Software engineering fundamentals including version control, code review, testing, CI/CD, observability, and on-call responsibility for services you've built
• Hands-on payment cryptography operations experience with payment HSM services (cloud-hosted such as VirtuCrypt, AWS CloudHSM, Google Cloud HSM, or on-prem operated as a service), including payment key management with PIN keys, DUKPT, master/session key hierarchies, and TR-31 or TR-34 key exchange
• Key lifecycle management experience with PCI PIN and PCI-DSS scope
• Application security at scale: SAST, DAST, and SCA toolchain design and rollout, threat modelling as routine practice, and familiarity with modern AppSec tooling (Snyk, Wiz, Veracode, Checkmarx, Semgrep, GitHub Advanced Security or equivalents)
• Cloud security depth on AWS including IAM design, workload identity, network isolation, and integration patterns between application workloads and HSM-backed key services
• Strong written communication: you will publish runbooks, standards, ADRs, and reporting dashboards as documentation is how work gets done
• Comfort working in a small team carrying real regulatory scope where PCI-DSS, PCI PIN, DORA, and GDPR are constraints on the work, not optional context

Nice to have

• Open source contributions or side projects to demonstrate how you write code
• Payments industry experience such as card acquiring, issuing, PIN, EMV, or terminal fleet operations
• Experience in a regulated fintech environment under FCA, ECB, or equivalent supervisory scope

What we offer

• Flexible working hours, as long as it suits both you and your team
• Health insurance
• Physical and mental health support through partnership with MyFitness
• 25 days of annual leave plus bank holidays
• Possibility to visit other Teya offices to meet colleagues when travel is safe and appropriate
• Friday lunch in the office
• High-end work equipment and informal office environment
• Hybrid work mode policy

About Teya

Teya is building a financial platform for local businesses across Europe, designed around simple tools, thoughtful design, and real human support. Operating as a regulated payments fintech across multiple European markets, Teya is scaling toward banking-licence territory and focused on solving real problems for the cafés, restaurants, salons, shops, and entrepreneurs that make up the backbone of local communities.