Lead Edge Platform Security Engineer

OneBanxOneBanx builds and runs a fintech platform that powers self-service banking kiosks. We are looking for an experienced engineer who combines DevSecOps (development, security and operations) skills with a real passion for networking and network devices. The role brings together three areas of equal importance.THE ROLE Edge networking: you will own and improve the network that connects our kiosks, built on OpenWrt and pfSense devices deployed in the field and managed remotely as a fleet.

This calls for hands-on experience with network devices and a strong interest in how they behave in real-world conditions. DevOps enablement: our engineers already run much of their own infrastructure, so this is not about owning everything; you will set best practice, build the reusable GitLab pipeline and Terraform templates the team relies on, and support them where they need specialist help.Security: you will drive most of our security work, from annual penetration test to pushing hardware suppliers to a higher security standard.Key ResponsibilitiesEdge NetworkingOwn the kiosk network end to end, from on-site devices through to the secure connection back to our platformMaintain and improve OpenWrt and pfSense configurations, firmware and upgrade processes across a remote fleetAct as the escalation point for connectivity issues and turn recurring problems into permanent fixesLead the evolution of how devices connect and authenticate, moving towards a modern model where each device proves its identity and requests only the access it needsKeep site build standards and runbooks up to date so kiosks can be deployed and supported reliablyDevOps EnablementBuild and maintain reusable GitLab CI/CD (continuous integration and delivery) pipeline templates, with security scanning built inCreate Terraform best-practice templates and modules that the team can adopt for their own infrastructureCoach engineers on infrastructure-as-code, secrets handling and secure pipeline design, rather than doing it for themSupport the team on infrastructure work outside their day-to-day expertise, and document it so it is repeatableLook after our self-managed GitLab instance, including routine upgradesContribute to architecture decisions and write them up so the wider team understands the reasoningSecurityDrive our security improvement work, reporting to the CTOOwn the annual penetration test: scoping, managing the testing firm, triaging findings and tracking fixes to closureMaintain a security improvement backlog across cloud infrastructure, developer tooling and the kiosk estatePush our hardware and firmware suppliers to improve their security: assessments, patch commitments and contractual requirementsSet the patching and vulnerability management cadence for infrastructure and network devicesOwn certificate, key and credential lifecycles, including rotationSupport audits and customer security due diligence with clear evidence and documentationWhat you will work onA flavour of the problems this role will tackle:Edge Network: OpenWrt and pfSense devices deployed in the field and managed remotely as a fleetDevice Identity: Moving towards a model where devices enrol, authenticate and request access securelyPlatform Templates: Shared GitLab CI/CD and Terraform templates that make the secure way the easy way for every teamSecure Pipelines: Security scanning and secrets handling built into how every team shipsPenetration Testing: Running the annual test and making sure findings are fixed, not just filedSupplier Security: Working with hardware and firmware suppliers to raise their security standardsSkills, Knowledge & ExpertiseEducation Level:BSc Computer Science, IT or software engineering related qualification (desirable)REQUIRED SKILLS AND COMPETENCIES We do not expect one person to be an expert in everything below; we do expect hands-on experience in each area, and real depth in at least one.Core skills and technologies·        OpenWrt·        pfSense·        WireGuard / OpenVPN·        GitLab CI/CD·        Terraform·        AWS·        Linux / Shell / Python·        Secrets & Certificate Mgmt·        Penetration Testing·        Vulnerability Management·        Supplier Security·        Network SecurityEssential — Networking & DevicesHands-on experience with OpenWrt and pfSense (or OPNsense) on real hardwareVPN technologies such as WireGuard and OpenVPN: configuration, key management and troubleshootingStrong TCP/IP fundamentals: subnetting, routing, DNS, DHCP, VLANs and firewall designExperience managing remote devices where a mistake can mean a site visitEssential — DevOpsWriting and maintaining GitLab CI/CD pipelines, ideally including shared templates used across many projectsTerraform: modules, remote state, state locking and safe plan/apply workflowsWorking knowledge of AWS, particularly networking and IAM (identity and access management)Comfortable in Linux and with scripting in shell and/or Python; familiar with administering self-hosted tools such as GitLabEssential — SecurityPractical involvement in penetration testing: scoping, remediation planning and re-testingVulnerability management: reading advisories, scoring severity and prioritising patchesSecrets and certificate management in production environmentsConfidence working with third parties to agree and track security improvementsDesirable skillsThe following are not required but will distinguish exceptional candidates:Device Fleet & IoTFleet management tooling for routers or other network devicesIoT (Internet of Things) device identity and enrolment: device certificates, zero-touch provisioning, mutual TLSCellular (4G/LTE) connectivity on Linux-based devicesPlatform & DeliveryContainer platforms and image security scanningPolicy-as-code or automated compliance checks in pipelinesCentralised logging and monitoring for both cloud and remote devicesSecurity & ComplianceExperience in fintech, payments or another regulated environmentSupplier security assessment and third-party risk managementSecurity certifications such as OSCP, CompTIA Security+ or CISSP (helpful, not essential)Ideal candidate profileBeyond technical credentials, we value engineers who embody the following:Passion for networks and devices: you enjoy the hands-on side as much as the automationEnabler, not gatekeeper: you raise the team’s capability rather than becoming a bottleneckSelf-driven: you take the initiative on security and see improvements through without being chasedOwnership mentality: you see problems through to a permanent fixCareful with change: you plan rollouts and rollbacks, whether for pipelines or for devices in the fieldFirm but constructive with suppliers: comfortable pushing vendors to meet the standard we needClear communicator: able to explain risks and decisions to engineers and non-technical stakeholders alikeJob BenefitsDepartmentProduct Mgmt - Product PromotionEmployment TypePermanent - Full TimeWorkplace typeFully remote