About Us
Duco is on a mission to reduce the time spent on data-related work by 90%. Our enterprise data automation platform empowers teams to work more efficiently and meaningfully by giving them the ability to automate data controls with the latest technology, such as no-code, the cloud, and AI.
We help firms to start trusting their data, by giving them one intuitive platform to automate the front-to-back processing of all kinds of data (from structured Excels and RTFs to unstructured PDFs and emails). This eliminates the boring manual work across the data lifecycle and enables firms to act faster, work smarter, save money, reduce risk and comply with regulatory requirements.
We’re headquartered in London and have offices in New York, Wroclaw, Singapore, and Antwerp. We’re proud to call some of the largest global financial institutions our clients, including over 15 of the world’s largest international banks, as well as brokers, exchanges, asset managers, hedge funds, administrators, service providers and corporates.
The opportunity
We are seeking an experienced Senior Application Security Engineer to take ownership of security across our software development lifecycle (SDLC). In this role, you will establish secure delivery as the default for our engineering teams, from design and code through to the pipelines that release it.
You will own our Application Security Posture Management (ASPM) platform, Ox Security, and ensure its findings translate into effective remediation. This includes reducing noise, prioritising vulnerabilities that are genuinely exploitable and partnering closely with engineering teams to resolve them. You will also define our approach to threat modelling, security testing and the integration of security guardrails into our CI/CD pipelines.
You will join a small, collaborative Information Security team based across London and Wrocław, working alongside our Senior Security Engineer (Cloud & SecOps) and our Governance, Risk and Compliance (GRC) function. You will work closely with our Engineering teams on a day-to-day basis and report to the Head of Information Security.
Key responsibilities
Secure SDLC and pipeline security
Vulnerability management and remediation
Secure design and engineering enablement
Client assurance, reporting and threat awareness
Skills and experience
Desirable
The reward package
Head over to our Glassdoor page to learn about our benefits, culture and to find out what our team thinks about life at Duco. You can also find out more about us on LinkedIn
Disclaimer
Because we are committed to inclusivity, we strive to provide equitable opportunities for everyone. If you require accommodation during the recruitment process, please let us know at [email protected]. Include your contact information, the role you're applying for, and how we can accommodate you.
During the interview process and after hire, Duco does not discriminate on the basis of race, colour, gender or gender expression, sexual orientation, marital or pregnancy status, national origin, age, disability, religion or creed, socioeconomic background or status, size, or any other protected characteristic.
Job details are sourced from the employer's original posting.
Open job postingAbout the company
Duco supports policy, intelligence, trust & safety, operations, research, and other teams at American technology companies. We act as an extension of these teams to provide quick-turn, high-quality expert analysis on everything from strategic planning to crisis response to threats evolving from emerging technology. Duco HQ works with the Client to define project goals and assemble relevant experts. Then, Duco manages the expert teams, guides their work, ensures quality, and delivers the Client the results they need. Our team includes thousands of world-class experts in over 75 countries. We design and deliver custom reports, executive briefings, trainings, surveys, red-teaming exercises, risk assessments, on-platform or cross-platform content review/labeling to inform content moderation decisions and train artificial intelligence, regulatory and industry landscape analyses, and other tailored solutions. On content, we have experience providing analysis of both general trends and specific content across dozens of languages, including projects related to mis/disinformation, incitement to violence, child safety, scams, impersonation, elections, dangerous organizations, inauthentic behavior, foreign interference, hate speech, data privacy, and more.