Team Overview
Zopa’s Product Security team ensures security is baked into our products from the very start of their lifecycles, all the way to the end. We provide the pre‑emptive, design‑thinking‑led side of securing the bank. If we do our job right, security becomes inherent in the design of our products, rather than something grafted on after.
We are a team of 4 within a larger InfoSec team of 18. Our current projects include ongoing security assessments and threat models of new, in‑house created AI‑based systems, improving our security tools such as SAST and SCA, refining a SLSA strategy, helping to roll out an upcoming bounty program and more. We pride ourselves in collaborating and integrating seamlessly with engineering functions, working directly with product security peers and across engineering to help design, architect and build new features and products for the bank.
A Day in the Life
- Advocating security for product owners and engineers, building working relationships.
- Performing web, mobile and backend security assessments directly.
- Orchestrating security assessments between product teams and third‑party assessors when required.
- Weighing in on technical architecture discussions to ensure security is considered from inception of new features.
- Threat modelling upcoming features, providing technical guidance to illustrate security concerns.
- Overseeing secure engineering training programmes, keeping engineers aware of secure engineering practices.
- Integrating security tooling, stitching together CI steps, scripts and small tools to automate security controls and visualise the results, including SAST, SCA, DAST, secrets scanning, vulnerability scanning and other tooling.
- Guarding our Secure Development Lifecycle, ensuring security controls are baked in and “pushed left” as much as reasonably possible.
- Triaging incoming reports and findings from bug bounties, automated tools and more.
- Learning about emerging technologies around the clock to understand security concerns, with appropriate time allocated by the company.
- Advising engineers on security patching and ensuring our own tools remain patched.
- Balancing security and productivity, managing stakeholder concerns around trade‑offs.
About you
- Experience in offensive security, performing assessments with tools like BurpSuite, nmap, Kali Linux, etc.
- Strong experience with at least one web or mobile OS, with a willingness to learn the other.
- Fundamental networking and OS knowledge; debugging DNS, comfortable with command‑line tools and computing principles.
- Comfortable threat modelling, assessing the balance between features and security, explaining trade‑offs to less technical stakeholders.
- Basic scripting knowledge; familiarity with in‑house tools.
- Willingness to learn basic software engineering principles to keep tools maintainable, confident in at least one language such as Python, JavaScript or Go.
- Secure coding practices; providing detailed guidance to fix and prevent vulnerabilities such as SQL injection.
- Providing security advice during architectural design phases, spotting fundamental flaws early.
- Basic cloud infrastructure knowledge, understanding VM fundamentals, software‑defined networks and infrastructure as code.
Added bonus
- Experience in fintech, especially banks with mobile apps.
- Ability to read common tech‑stack languages not commonly used in InfoSec, e.g. Java and C#, to assist white‑box assessments.
- Knowledge of fundamental software engineering practices to maintain internal tools.
Flexible Working
We value face‑to‑face collaboration and a good work‑life balance. This hybrid role requires you to come to our London office 2-3 days a week. You’ll also have the option of working from abroad for up to 120 days a year, subject to having the right to work in the chosen country.
Diversity Statement
Zopa is proud to offer a workplace free from discrimination. Diversity of experience, perspectives and backgrounds leads to better products for our customers and a unique company culture for our people. We are made up of nearly 50 nationalities, have a DE&I forum made up of Zopians wanting to make a difference and we are proud of our culture where everyone can bring their full self to work. Our approach to DE&I is reflected in our hiring process so please let us know if you require any reasonable adjustments.
#J-18808-Ljbffr…