Security and Compliance Engineer - Griffin

About Griffin

Griffin is a fully regulated UK bank powering accounts and payment offerings for product-led fintechs and platforms like Uber, Yonder, Prosper, and Sidekick. By handling the heavy lifting behind the scenes, we allow our customers to focus on delivering great user experiences.

Having grown rapidly since our launch in 2024, we provide the banking backbone for remittance, payroll, wealth, insurance, proptech, neobanking, and more. Next, we are expanding into card issuing, stablecoin infrastructure, and agentic finance.

Our Culture

We believe that smart, motivated, and conscientious people thrive in high-trust, high-autonomy environments. Griffin has been remote-first since 2017, and our work is asynchronous and fully flexible to help you get the most out of both work and personal life.

The Team

The Craft function consists of seven small, cross-functional engineering teams comprising engineers, an engineering manager, and a product manager collaborating closely with designers.

You will work across the Craft function with the remit of enhancing our controls and cybersecurity governance. You will report to the Engineering Manager for Infrastructure while working closely with CTO and Founder, Allen Rohner.

The Opportunity

We are looking for an Engineer 1.5 to become the engineering voice of security, compliance, and assurance at Griffin. Sitting across engineering, security, risk, and operational resilience, you will translate standards and regulatory expectations into practical controls that engineers actively use—building and shipping these controls directly to production alongside engineering teams.

What Success Looks Like

• First 6 Months: Take ownership of certification, attestation, and audit work (including ISO 27001 and SWIFT), ensuring evidence is organized and findings are resolved. Maintain engineering risk and controls, enhance release and change management, and ship automation for control checks into the production codebase.
• Month 12: Ensure resilience plans (including Important Business Service technical mapping, business continuity planning, and disaster recovery) remain current and streamline security processes through smart automation.

Key Responsibilities

• Control Design & Cyber Security Governance: Translate standards into practical controls, writing and shipping production code to implement them across engineering teams.
• Certifications & Attestations: Lead documentation and technical readiness for SWIFT, FPS, SOC 2, and ISO 27001.
• Audits & Due Diligence: Own internal/external audits and customer due diligence requests, steering all findings through to remediation.
• Risk & Control Assessments: Manage Engineering Risk and Controls Self Assessments (RCSA) and recurring activities such as chaos testing and backup/restore validations.
• Release & Change Management: Continuously improve release processes, sampling deployments for policy adherence.
• Post-Incident Reviews: Facilitate reviews, track remediation actions, and share key technical learnings across teams.
• Operational Resilience: Contribute to DR plans, IBS technical mapping, and engineering third-party supplier management.

Requirements

• Hands-on engineering background with experience writing and shipping production code.
• Track record in security, compliance, risk, or assurance within a technical environment, including owning audits or certifications.
• Strong knowledge of compliance, risk, and cybersecurity principles, alongside change/release management and incident handling.
• Sharp assurance and analytical skills to spot technical gaps and execute follow-through.
• Strong stakeholder management and communication skills across engineering, compliance, and executive functions.
• Excellent written communication skills, with a passion for clear, readable technical documentation.

Nice to Have

• Familiarity with frameworks such as SOC 2, ISO 27001, SWIFT, and FPS within a regulated fintech or challenger bank.
• Experience automating compliance and security workflows using code.

Benefits

• Remote-First Flexibility: Work from anywhere in the UK (with an optional London office available).
• Work from Abroad: Up to 20 days per year.
• Time Off: 25 days of annual leave, public holidays, and a company-wide winter shutdown between Christmas and New Year.
• Share Options: Equity ownership in Griffin.
• Pension: Auto-enrolment via Penfold.
• Health & Life Cover: Private medical insurance via Bupa (including family cover) and life insurance via AIG.
• Mental Health & Wellbeing: 1:1 coaching and therapy sessions via Oliva.
• Family Leave: Enhanced parental leave (up to 6 months full pay after 2 years of service).
• AI & Productivity Tools: Claude subscription and access to modern developer tooling.
• Home Office Setup: Support and budget to build an ergonomic home workspace.