Senior Security Engineer

About OneView Commerce

For retailers with thousands of shops, commerce platforms have historically fallen into two categories, each with significant drawbacks. Web-native platforms move fast but were never built for a shop floor. Legacy store systems were built for the shop floor but take a year to change anything. OneView Commerce is the third option: a headless commerce platform for physical retail that lets the world's largest retailers innovate just as quickly as the smaller ones. We ship store experiences that deploy fast out of the box, and we give retailers the freedom to build their own on top of a headless transaction engine engineered for the physical store rather than the browser.

Our customers are global retailers who build on OneView because it lets them keep moving: new journeys, new channels, and new store formats ship continuously rather than waiting on the next multi-year program.

Founded in 2010 to close the gap between fast-moving e-commerce and slow-moving in-store systems, OneView's founding principle is a single view of customers, orders, and inventory throughout the shopping journey. That remains our mission as we enable retailers to deliver exceptional store experiences that build loyalty.

We are a remote-first team with Viewers working across the globe, and we operate as a trusted provider of digital commerce systems for leading retailers.

Position summary

OneView is looking for a Senior Security Engineer to join our DevSecOps team and own the growth and ongoing management of our InfoSec program, covering cloud-hosted applications and infrastructure, security culture, and customer security requirements.

You write security policy and standards, which the Sr. Director of Platform Engineering approves, and design the controls that implement them. The team's technical product owner ranks security work on the backlog with everything else, and platform engineers build most of it. Most of your time goes to design, review, assurance, and incident work; you also write Terraform when it is the fastest way to get a control in place. You work with engineering, delivery, and executive stakeholders on decisions that need a security view.

You report to the Sr. Director of Platform Engineering, who sets vision, strategy, and the roadmap for Platform Engineering, and owns how the team's work gets done: technical approach, standards, assignment, and quality. This is an individual contributor role with no direct reports.

Our approach is defense in-depth and shifting security checks earlier in the delivery pipeline.

We use AI throughout our day-to-day work and want you to find uses for it we have not thought of. We also expect you to be able to do this job well if it were switched off tomorrow, because the judgment calls and the relationships with auditors and customers are yours.

Responsibilities

• Set the requirements for automated threat detection, response, and remediation in our cloud-hosted environments, choose the tooling with our platform engineers, and own the detection rules and response procedures it runs.
• Lead internal threat assessments of our environments.
• Assess our environments and security program against industry frameworks such as the CIS Benchmarks and the NIST Cybersecurity Framework.
• Review our external attack surface, including what public sources reveal about OneView.
• Design remediation plans and policies for security vulnerabilities. Write each fix as a backlog item with acceptance criteria and the evidence that will show it is complete, and give the team's technical product owner the risk assessment needed to rank it.
• Set the application security testing standards for development teams, including the automated security tests that run in our pipelines and the results a change must meet before release, and review findings with the engineers who fix them.
• Implement security controls in Terraform when that work is assigned to you, and review infrastructure as code changes that affect security.
• Plan and run the independent security assessments our customers require, such as penetration tests and third-party security assessments, and those we commission ourselves. Agree the scope with the assessor, and with the customer where they require it, act as OneView's point of contact during the assessment, and track each finding to closure.
• Lead security incident response, and act as the first escalation point for security incidents.
• Own external security audits of OneView end to end. Define and compile the evidence each control needs, attend the sessions with the auditors, answer their questions, and decide which information is appropriate to provide.
• Represent our security posture to customers through security reviews, questionnaires, due diligence, and follow-up discussions with the customer's security team.
• Identify platform security investments before anyone requests them, build the case for what each one is worth, and take it through the team's technical product owner to the Sr. Director and the executives who fund the work. Once it is approved, specify the work and verify the result.
• Explain security issues to engineers who need to change something, delivery leads who need to plan around it, and executives who need to decide, at the depth each one needs.

Required skills & experience

• 7+ years in software or cloud security with a hands-on engineering background, with working experience in each of the following areas, using one or more of these or comparable tools:
  • Cloud platforms: AWS, Google Cloud, Microsoft Azure
  • Infrastructure as code: Terraform with Terragrunt, CloudFormation
  • CI/CD: CircleCI, GitHub Actions, GitLab CI/CD
  • Security testing (static analysis, software composition analysis, container scanning, and infrastructure as code scanning): Snyk, Semgrep, SonarQube, Checkmarx, Veracode, Trivy, Checkov
  • Cloud security services: AWS Security Hub, Amazon GuardDuty, Google Security Command Center
  • Detection and logging: Splunk, Elastic, Datadog, Microsoft Sentinel, Google Security Operations
• Has built or specified security gates in CI/CD pipelines that stop a change that fails a security requirement.
• Has hands-on experience with infrastructure as code guardrails, secrets and key management, and policy as code.
• Has prepared the evidence for an external security audit or certification, such as ISO 27001, PCI DSS, Cyber Essentials Plus, or SOC 2, and answered the auditors' questions in the audit sessions. Knows what to disclose, what to defer, and when to say "I do not know".
• Has scoped an independent security assessment, such as a penetration test, and tracked its findings to closure.
• Has led the response to a major security incident, including containment, stakeholder communication, and the post-incident review.
• Has answered a customer's security team directly, including the people whose job is to test the answers they are given.
• Can explain security to people who are not security specialists.
• Has identified a security investment that had not been requested, built the case for it, and got it funded or scheduled. Can describe the argument that worked and the one that did not.

Preferred skills & experience

• Has taken a new product through ISO 27001, PCI DSS, or Cyber Essentials Plus certification.
• Has worked under a formal data classification scheme set by a customer or a regulator, and knows what each tier requires in practice: data residency, access control, encryption, retention, and who is cleared to handle it. Public sector, defense, financial services, and healthcare regimes qualify.
• A security certification such as CISSP, CCSP, OSCP, AWS Certified Security Specialty, or Google Professional Cloud Security Engineer.
• Written security documentation, including evidence packs, control narratives, and security policy.
• Has incorporated AI into their security practice, for example triaging scan output and drafting control narratives.
• Understands how contractual and regulatory restrictions limit what data may be processed by AI tooling, and can explain the operational implications to a team that wants to use it.
• Has represented a supplier at a customer's security governance forum, change advisory board, or service review.
• Experience of a regulated or public sector engagement where the security posture had contractual or financial consequences.
• Has run a security awareness or culture initiative that changed how other teams behaved, and can say how they know it did.
• Active in the security community, through conferences, vulnerability disclosure, open source, or research.

Why OneView

Alongside the global retailers we already serve, we have recently been selected by one of the largest store networks in the world to replace their legacy store system, and are pursuing more retailers that have decided to replace theirs. All of that work runs on the platform this role secures.

Our teams operate independently. We expect people to identify what should be done differently, and they have the support of their team and of leadership to make the change.

OneView has been named one of Built In's Best Places to Work for three years in a row. Our leadership team brings decades of experience across software development, delivery, sales, and marketing.

OneView Commerce is an equal opportunity employer. All qualified applicants will be considered for employment without regard to race, colour, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status. If you need adjustments to take part in the recruitment process, tell us and we will make them.

We do not accept CVs from agencies, headhunters, or other suppliers who have not signed a formal agreement with us.

Applicants must have current, ongoing right to work in the UK. OVC is not a licensed visa sponsor and is unable to sponsor a Skilled Worker visa or any other employment visa for this or any role, now or in the future. Evidence of right to work will be required prior to any offer of employment.