Security Engineer 3 - Vulnerability Management

The Product Security team at Tide is responsible for embedding security across the full product surface, from secure design and threat modelling through to application-layer controls and vulnerability management. Within Product Security, the Remediation Operations function owns the day-to-day engine of Tide's vulnerability management programme: turning a high volume of findings from across our tooling estate into clear, prioritised, actionable work for engineering and IT teams. This role sits at the heart of that function. You will be the connective tissue between security tooling and the teams who fix things, making sure the right vulnerabilities reach the right people with the right context, and that they actually get resolved. This is a delivery-focused role for someone who measures success not by findings raised, but by risk reduced.

Responsibilities

Triage and validate vulnerabilities surfaced by Tide's core security tooling, including Wiz, Semgrep, CrowdStrike Exposure Management and External Attack Surface Management (EASM) platform, separating signal from noise and confirming which findings are real, exploitable and relevant to Tide; Support risk-based prioritisation, helping to rank findings by severity, exploitability, asset criticality and business context; Automate remediation workflows within Tide's vulnerability management platform (Seemplicity), building and refining the routing, ticketing, deduplication and escalation logic that keeps findings moving without manual overhead; Verification and Validation of the Fix implemented through targeted re-scanning or manual checks, ensuring risks are genuinely mitigated before tickets are formally closed; Act as a trusted partner to engineering and IT teams, explaining the importance and technical detail of specific findings, advising on practical fixes, and helping teams understand the reasoning behind each request rather than treating it as a box-ticking exercise; Build reports and dashboards that give clear visibility of vulnerability posture, remediation progress, SLA adherence and trends, tailored for both technical owners and senior stakeholders; Design and run nudging strategies to shift fix behaviours across engineering and IT, using data, well-timed prompts and the right incentives to drive down time-to-remediate and reduce recurring issues; Maintain the health of the remediation pipeline, monitoring ageing findings, chasing stalled items, identifying systemic blockers and feeding that insight back into the wider vulnerability management strategy; Contribute to continuous improvement of remediation operations, refining processes, SLAs, taxonomies and tooling configuration as Tide's environment and threat landscape evolve

Requirements

Hands-on experience in vulnerability management or a similar analytical security role; Familiarity with vulnerability and exposure tooling such as Wiz, Semgrep, CrowdStrike, EASM platforms, or comparable scanners, along with a solid understanding of how to interpret and validate their findings; A good grasp of vulnerability scoring and prioritisation concepts including CVSS, EPSS, CISA KEV exploitability and asset context, with the judgement to know when a severity rating needs a human sense-check; Facilitate the risk acceptance and exception management workflow, ensuring that deferred remediations are properly documented, justified, approved by stakeholders, and tracked for future review; Experience with, or a strong appetite to work with, workflow automation and orchestration, whether through a dedicated platform such as Seemplicity, light scripting, or integrations between security and ticketing tools; Confidence building reports and dashboards that turn messy data into clear narratives; Strong communication and stakeholder skills, comfortable explaining technical findings to engineers and translating remediation progress into metrics for senior leaders; A pragmatic, delivery-focused mindset: you care less about cataloguing problems and more about getting them fixed

Nice to have

Fast-moving, cloud-native environment experience; Experience in fintech, regulated financial services, or a similarly high-assurance environment

Benefits

Competitive salary and share options; Generous annual leave on top of bank holidays; Paid maternity, paternity, and adoption leave; Extended unpaid and paid leave options after completing milestone years with Tide; Private family insurance with additional OPD coverage and top-up options; Comprehensive accidental and life insurance protection; Access to therapy sessions, courses, meditations, and workshops; Paid days annually for volunteering or personal growth; Annual budget for books, courses, coaching, and more; Work from abroad for up to 90 days annually; Contribution towards setting up your home office; Keep your old laptop and get a new one when it's time for a replacement; Office perks with snacks, coffee, tea, and lunch (location dependent)